CVE-2026-5476 | NASA cFS up to 7.0.0 on 32-bit cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflow (Issue 954 / EUVD-2026-18814)

A vulnerability marked as critical has been reported in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFE_TBL_ValidateCodecLoadSize of the file cfe/modules/tbl/fsw/src/cfe_tbl_passthru_codec.c. The manipulation leads to integer overflow.

This vulnerability is traded as CVE-2026-5476. Access to the local network is required for this attack to succeed. There is no exploit available.

A fix is planned for the upcoming version milestone of the project.