CVE-2026-92158
HighCVSS 7.2Summary
F´ (F Prime) before version 4.2.0 has a vulnerability in the Svc::FpySequencer STORE directive stack write validation. The bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid.
Risk Assessment
An attacker can cause memory corruption, denial of service, and potentially code execution on the embedded system.
Recommendation
Upgrade F´ (F Prime) to version 4.2.0 or later.
Other vulnerabilities in F´ (F Prime)
See all- CVE-2026-92155High
F´ (F Prime) before version 4.2.0 has a vulnerability in Fw::FilePacket deserialization used by Svc::FileUplink. Header deserialization casts the byte to the Type enum without validating its range, and FilePacket::fromSerialBuffer reaches a default FW_ASSERT when a network file packet contains an unknown file-packet type byte.
- CVE-2026-92154High
F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::FileUplink handleDataPacket offset and size validation. The component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing.
- CVE-2026-92150High
F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::GenericHub fromBufferDriver_handler deserialization. The receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow.
- CVE-2026-92153High
F´ (F Prime) prior to 4.3.0 has a vulnerability in Svc::FileUplink where the destination path from a StartPacket is copied and opened for writing without canonicalization or confinement to an upload directory. This allows creating or overwriting files at attacker-selected locations.
- CVE-2026-92151High
F´ (F Prime) prior to 4.2.0 has a vulnerability in Svc::Ccsds::SpacePacketDeframer where the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting the buffer. When a telecommand frame leaves six or fewer bytes, the assertion aborts or resets the process, causing denial of service.
- CVE-2026-92152Critical
In F´ (F Prime) from 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution.
Original NVD description (English source)
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS