CVE-2026-92150 Details
Description
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.
A denial-of-service vulnerability has been identified in the F' (F Prime) framework, specifically within the Svc::GenericHub component, in versions prior to 4.2.0. The issue arises in the fromBufferDriver_handler function, where the deserialization of command payloads is improperly validated. This flaw allows an unauthenticated inter-processor hub peer to send truncated buffers or malformed command-dispatch payloads, causing the flight software process to crash. In multi-processor deployments, this can disrupt communication between all connected nodes.
Users are advised to update to F' version 4.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986 | [email protected] | Source CodeVendor |
| https://github.com/nasa/fprime/pull/4929 | [email protected] | Source CodeVendor |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | [email protected] | Release NotesVendor |
| https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| F Prime | <= 4.2.0a1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |