NASA cFS Health & Safety (HS) Application NULL Pointer Dereference (CVE-2026-18064)

Technical Analysis

CVE-2026-18064 (CWE-476: NULL Pointer Dereference) affects the NASA cFS Health & Safety application, a monitoring component used in flight software and other embedded control systems built on the Core Flight System framework. The flaw is a remnant of an incomplete patch for CVE-2026-15352, meaning the previous remediation did not fully close the code path that allows a NULL pointer to be dereferenced when a specific command is sent under certain conditions. Exploitation is network-reachable, requires no authentication or user interaction, and results in application crash and processor reset (CVSS 3.1: 7.5 HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). This is an embedded/OT-focused flight software vulnerability with no direct code path to AI agent or LLM tool-use infrastructure, so no AI agent impact applies here; however, organizations should note that cFS is open-source and reused across spacecraft, satellite, and other mission-critical platforms, so any autonomous or agent-driven mission control systems interfacing with cFS-based telemetry should validate resilience against malformed HS commands.

Affected Systems

NASA Core Flight System (cFS) Health & Safety (HS) Application versions <=7.0.1 (github.com/nasa/HS)

Indicators of Compromise

• N/A - no known IOCs; no public exploitation reported

Remediation Steps

1. 1

   Update to patched dev branch

   Update the HS application from the official repository (https://github.com/nasa/HS) to the latest dev branch, which includes the fix starting at commit 828855f971db4b6714367ed0a970f52dbeab296.

2. 2

   Monitor for official release

   Track NASA's official cFS HS repository for a stable release incorporating the permanent fix, as one is currently under development.

3. 3

   Network segmentation

   Minimize network exposure of control system devices; ensure they are not accessible from the internet and are isolated behind firewalls from business networks.

4. 4

   Secure remote access

   Use VPNs or other secure remote access methods when control system access is required, keeping VPN software updated.

5. 5

   Command validation

   Implement input validation and command filtering to prevent malformed or unexpected commands from reaching the HS application.