CVE-2026-18064

An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-06.json
https://github.com/nasa/HS
https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-06

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una solución incompleta para CVE-2026-15352 en la aplicación de Salud y Seguridad (HS) del Sistema de Vuelo Central (cFS) de la NASA deja una desreferencia de puntero NULL separada accesible en versiones hasta la 7.0.1. Un atacante que pueda activar el comando afectado bajo condiciones específicas podría causar que la aplicación HS falle, lo que resultaría en una condición de denegación de servicio y un reinicio del procesador.

Information

Published : 2026-07-30 22:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-18064

Mitre link : CVE-2026-18064

CVE.ORG link : CVE-2026-18064

JSON object : View

Products Affected

No product.

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-18064", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18064", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T15:40:36.521992Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "NASA", "product": "Core Flight System (cFS) Health & Safety (HS) Application", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "v7.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T22:16:54.790", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-06.json", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://github.com/nasa/HS", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-06", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "An incomplete fix for CVE-2026-15352 in the NASA core Flight System \n(cFS) Health and Safety (HS) application leaves a separate NULL pointer \ndereference reachable in versions through 7.0.1. An attacker who can \ntrigger the affected command under specific conditions could cause the \nHS application to crash, resulting in a denial-of-service condition and \nprocessor reset."}, {"lang": "es", "value": "Una soluci\u00f3n incompleta para CVE-2026-15352 en la aplicaci\u00f3n de Salud y Seguridad (HS) del Sistema de Vuelo Central (cFS) de la NASA deja una desreferencia de puntero NULL separada accesible en versiones hasta la 7.0.1. Un atacante que pueda activar el comando afectado bajo condiciones espec\u00edficas podr\u00eda causar que la aplicaci\u00f3n HS falle, lo que resultar\u00eda en una condici\u00f3n de denegaci\u00f3n de servicio y un reinicio del procesador."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "ics-cert@hq.dhs.gov"}