CVE-2026-92157 Details
Description
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
A denial-of-service vulnerability has been identified in the NASA F' framework, specifically within the FileDownlink component's SendPartial command. This issue arises from an integer overflow caused by unchecked arithmetic on the startOffset and length parameters, which are both treated as normal U32 command values. Prior to version 4.3.0, the command validation process incorrectly allows wrapped values to bypass range checks, leading to a situation where the end offset is set to a value that causes an assertion failure during normal operation. The vulnerability can be exploited by sending a well-formed SendPartial request that takes advantage of the arithmetic wraparound, causing the process to crash or reset.
Users can upgrade to F' version 4.3.0 or later, where this vulnerability has been fixed. Instructions for upgrading can be found in the F' release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nasa/fprime/security/advisories/GHSA-hcmw-g425-8h9g | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14985669fbad09f070e9914 | [email protected] | Source CodeVendor |
| https://github.com/nasa/fprime/commit/95eeb5cfb44e5609eff0887f0e11e640cdacef6b | [email protected] | Source CodeVendor |
| https://github.com/nasa/fprime/pull/5565 | [email protected] | Issue TrackingVendor |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | [email protected] | Release NotesVendor |
| https://github.com/nasa/fprime/security/advisories/GHSA-hcmw-g425-8h9g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| F Prime | <= 4.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |