CVE-2026-92156 Details
Description
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
A denial-of-service vulnerability has been identified in the NASA F' framework, specifically within the Event Manager component of the Svc module, in versions prior to 4.3.0. The issue arises when the Event Manager processes event payloads that exceed its logging budget, leading to assertion failures and process resets. This vulnerability is particularly concerning when events are bridged from GenericHub, as it allows remote or adjacent peers to inject oversized log buffers that the Event Manager cannot handle, causing the application to crash.
Users can upgrade to F' version 4.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755 | [email protected] | Source CodeVendor |
| https://github.com/nasa/fprime/pull/5633 | [email protected] | Issue TrackingVendor |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | [email protected] | Release NotesVendor |
| https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NASA F Prime | <= 4.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | New CVE Received | [email protected] |
| Oct 14, 2026 | CVE Modified | CISA-ADP |