NASA Core Flight System (cFS) Health & Safety (HS) Application

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2026-15352, CVE-2026-18064. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. The following versions of NASA Core Flight System (cFS) Health & Safety (HS) Application are affected:

Core Flight System (cFS) Health & Safety (HS) Application <=v7.0.1 (CVE-2026-18064)

CVSS Vendor Equipment Vulnerabilities

v3 7.5 NASA NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference

Background

Critical Infrastructure Sectors: Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-18064

An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset. View CVE Details

Affected Products NASA Core Flight System (cFS) Health & Safety (HS) Application

Vendor:NASA Product Version:NASA Core Flight System (cFS) Health & Safety (HS) Application: <=v7.0.1 Product Status:known_affected

Remediations MitigationNASA reports that an official fix is currently under development and is expected to be included in a future software release. MitigationAs an interim mitigation, users can update their HS app from the HS repo (https://github.com/nasa/HS) to the latest dev branch. The fix is in the dev branch starting at commit …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2026-15352, CVE-2026-18064): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-06
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.