CVE-2026-67977 Details
Description
An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.
An integer overflow vulnerability has been identified in the Fprime framework version 4.2.2, specifically within the Svc::FileDownlink::SendPartial component. This vulnerability allows attackers to cause a denial-of-service (DoS) condition by sending crafted input that exploits unchecked addition of unsigned 32-bit integers during bounds validation. The manipulation can bypass intended range checks, trigger a reachable assertion, and ultimately crash the affected process, disrupting file downlink functionality and causing a denial-of-service for the active deployment.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/freedomfoxvare/cve/issues/1 | CISA-ADP | ExploitTechnical Description |
| https://github.com/freedomfoxvare/cve/issues/1 | [email protected] | ExploitTechnical Description |
| https://github.com/nasa/fprime | [email protected] | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| nasa fprime | 4.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |