Is CVE-2026-5474 actively exploited?

No active exploitation of CVE-2026-5474 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-5474 be exploited remotely?

Partially. CVE-2026-5474 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-5474?

CVE-2026-5474 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-5474

MEDIUM

CVE-2026-5474

CWE-119Published: April 3, 2026· Updated: Apr 7, 2026

6.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:3.0th

Official Description

A vulnerability was found in NASA cFS up to 7.0.0. This affects the function CFE_MSG_GetSize of the file apps/to_lab/fsw/src/to_lab_passthru_encode.c of the component CCSDS Packet Header Handler. Performing a manipulation results in heap-based buffer overflow. The attacker must have access to the local network to execute the attack. The project was informed of the problem early through an issue report but has not responded yet.

NVD Source

Technical Analysis

CVE-2026-5474 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.