CVE-2026-92152 Details
Description
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.
A vulnerability in the GenericHub component of NASA's F' framework, present in versions 4.1.0 prior to 4.2.0, allows for improper validation of array indices. The issue arises because the deserialized port index from remote hub packets is sent to various output functions without adequate range checks. In assertion-enabled builds, this can cause the application to abort, while in release builds, it can lead to out-of-bounds access on the output-port array, heap memory corruption, and potentially remote code execution. The vulnerability has been patched in version 4.2.0.
Users can update to F' version 4.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986 | [email protected] | Source CodeVendor |
| https://github.com/nasa/fprime/pull/4929 | [email protected] | Source CodeVendor |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | [email protected] | Release NotesVendor |
| https://github.com/nasa/fprime/security/advisories/GHSA-vv4x-5pmf-m59g | [email protected] | AdvisoryPartial ContentVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| F' | >= 4.1.0, < 4.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |