{"schema":"threatline.record/2","record":{"id":"CVE-2026-92156","aliases":["GHSA-6fxx-mgfv-55g7"],"summary":"F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge","details":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.","categories":["Unclassified"],"product":"fprime","vendor":"nasa","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92156","source_modified_at":"2026-10-14T17:52:06.724Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"fprime","vendor":"nasa","versions":[{"version":"< 4.3.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0054,"percentile":0.4465,"score_date":"2026-10-23"},"published_at":"2026-10-14T17:10:13.076Z","modified_at":"2026-10-14T17:52:06.724Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-92156","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T17:52:06.724Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92156","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/nasa/fprime/pull/5633","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/nasa/fprime/releases/tag/v4.3.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T17:50:45.621287Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T17:52:06.724Z","content_hash":"908c266728327d3a1f4724fdb993268337a3481084bd7a5c56a786e82f9c320f"}}