An incomplete fix for CVE-2026-15352 in the NASA core Flight System
(cFS) Health and Safety (HS) application leaves a separate NULL pointer
dereference reacha…

CVE-2026-18064 describes an incomplete fix for a prior vulnerability (CVE-2026-15352) in the NASA core Flight System (cFS) Health and Safety (HS) application. A separate NULL pointer dereference remains reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could crash the HS application. The resulting crash causes a denial-of-service condition and a processor reset. This vulnerability is particularly significant given its presence in aerospace/critical infrastructure software. CISA has published an ICS advisory (icsa-26-211-06) related to this issue. The incomplete patch nature of the vulnerability suggests remediation efforts require further attention.