High severity · published Apr 3, 2026
CVE-2026-5473
NASA cFS Pickle pickle.load deserialization
7.0
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation leads to deserialization. The attack needs to be performed locally. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
cFS · NASA
7.0 · source: vendor
CF
Core Flight System · Nasa
through 7.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5473
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5473
Product
https://github.com/nasa/cFS/
Issue Tracking
https://github.com/nasa/cFS/issues/951
Third Party Advisory
https://vuldb.com/submit/781949
Third Party Advisory
https://vuldb.com/vuln/355077
Permissions Required
https://vuldb.com/vuln/355077/cti
More from cFS
8.8
CVE-2026-5474
NASA cFS CCSDS Packet Header to_lab_passthru_encode.c CFE_MSG_GetSize heap-based overflow
7.4
CVE-2026-82480
NASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLength integer underflow
6.3
CVE-2026-82479
NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow
5.5
CVE-2026-5475
NASA cFS CCSDS Header Size cfe_sb_priv.c CFE_SB_TransmitMsg memory corruption
4.6
CVE-2026-5476
NASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflow