CVE-2026-92158 Details
Description
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.
A vulnerability in the F Prime framework's FpySequencer component, prior to version 4.2.0, allows for an out-of-bounds write via the STORE directive. This issue arises from improper validation of stack write parameters, where an attacker can manipulate the offset and size, causing an integer overflow. The overflowed values can then be used to write beyond the intended memory boundaries, leading to memory corruption. This vulnerability can cause a denial-of-service and potentially allow for code execution, depending on the application's memory layout and build flags.
Users can update to F Prime version 4.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nasa/fprime/security/advisories/GHSA-vfwv-3qv7-jjjq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nasa/fprime/commit/7527430d9ae7c88f3d649d376a45c866b0aed595 | [email protected] | Source CodeVendor |
| https://github.com/nasa/fprime/pull/4534 | [email protected] | Source CodeVendor |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | [email protected] | Release NotesVendor |
| https://github.com/nasa/fprime/security/advisories/GHSA-vfwv-3qv7-jjjq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| F Prime | 4.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |