CVE-2026-92154

F´ (F Prime) before version 4.2.0 has a vulnerability in the Svc::FpySequencer STORE directive stack write validation. The bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid.

F´ (F Prime) before version 4.2.0 has a vulnerability in Fw::FilePacket deserialization used by Svc::FileUplink. Header deserialization casts the byte to the Type enum without validating its range, and FilePacket::fromSerialBuffer reaches a default FW_ASSERT when a network file packet contains an unknown file-packet type byte.

F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::GenericHub fromBufferDriver_handler deserialization. The receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow.

F´ (F Prime) prior to 4.3.0 has a vulnerability in Svc::FileUplink where the destination path from a StartPacket is copied and opened for writing without canonicalization or confinement to an upload directory. This allows creating or overwriting files at attacker-selected locations.

F´ (F Prime) prior to 4.2.0 has a vulnerability in Svc::Ccsds::SpacePacketDeframer where the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting the buffer. When a telecommand frame leaves six or fewer bytes, the assertion aborts or resets the process, causing denial of service.

In F´ (F Prime) from 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution.