All vulnerabilities
CVE-2026-92157GHSA-hcmw-g425-8h9g

fprime: F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion

nasa fprime
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 20 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.3Fixed versionGitHub
Published14 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.

Text from CVE List

Affected versions 2

  • fprimeaffected: < 4.3.0CVE List
  • fprime<= 4.2.1GitHub

References 5