CVE-2026-105164: NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds
A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFEFSParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfefsapi.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
NASA cFS versions up to and including 7.0.1 are identified as affected. The available data does not identify specific configurations or deployments that are exempt.
What access does an attacker need to exploit this issue?
The vector is network-based, and the listed metrics indicate low attack complexity, no user interaction, and high privileges required. The supplied information does not specify which privileged role or interface is required.
What is the likely impact?
The issue is an out-of-bounds read that can affect availability. The provided scoring data indicates no confirmed confidentiality or integrity impact.
Is a fix available?
A pull request intended to fix the issue exists but was awaiting acceptance at the time of the supplied information. No released fixed version is identified.