CVE-2026-92150
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other…
- Risk score
- 59/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type valida…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.2.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
- https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986
- https://github.com/nasa/fprime/pull/4929
- https://github.com/nasa/fprime/releases/tag/v4.2.0
- https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93
- https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93
Original description
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.
Last activity 14 Oct 2026. Patch Forecast updates every hour.