NASA Core Flight System Vulnerability Could Lead to Denial-of-Service
A NULL pointer dereference vulnerability in NASA's Core Flight System Health & Safety application could allow unauthenticated attackers to crash the system and reset processors.
NASA's Core Flight System (cFS) Health & Safety (HS) Application, a critical component in spaceflight operations, has been found to contain a significant vulnerability that could lead to a denial-of-service (DoS) condition. Versions up to and including v7.0.1 are affected by this flaw, identified as CVE-2026-18064.
The vulnerability stems from a NULL pointer dereference within the HS application. Successful exploitation requires an attacker to trigger a specific command under certain conditions. If achieved, this could cause the HS application to crash, leading to a complete denial-of-service and potentially a processor reset. This could have severe implications for the stability and operation of systems relying on the cFS.
This vulnerability is not entirely new, as it appears to be an incomplete fix for a previous vulnerability, CVE-2026-15352. The ongoing nature of such issues highlights the challenges in securing complex flight software.
The CVSS v3.1 score for this vulnerability is a high 7.5, with a CVSS v4.0 score of 8.2, both indicating a HIGH severity. The attack vector is network-based (AV:N), requires no privileges (PR:N), and no user interaction (UI:N), making it particularly dangerous. The impact is primarily on availability (A:H), with no confidentiality or integrity impact.
NASA is actively working on a permanent fix, which is expected to be included in a future software release. In the interim, users can apply a mitigation by updating their HS application from the official GitHub repository (https://github.com/nasa/HS) to the latest development branch. The fix is available starting at commit 828855f971db4b6714367ed0a970f52dbeab2965 on the dev branch.
CISA has provided standard recommendations for critical infrastructure, including minimizing network exposure, isolating control system networks, and using secure remote access methods like VPNs. While no public exploitation has been reported to CISA at this time, the nature of the vulnerability and its potential impact warrant prompt attention from all users of the affected cFS HS Application.
The vulnerability was reported to CISA by Michael Holmquist of Hasp Labs. This incident underscores the ongoing need for rigorous security auditing and timely patching of software used in critical systems, especially those with long development cycles and high reliability requirements.