Deserialization Vulnerability in F´ Framework by NASA

CVE-2026-92150

What is CVE-2026-92150?

The F´ (F Prime) framework, utilized for developing embedded software applications in spaceflight systems, has a vulnerability related to its deserialization process in versions before 4.2.0. The issue arises from the Svc::GenericHub fromBufferDriver_handler, where the use of FW_ASSERT in externally influenced deserialization checks allows for improper handling of command payloads. If an unauthenticated peer sends malformed data, such as truncated buffers or invalid headers, it can lead to process aborts or resets, ultimately causing denial-of-service conditions. This vulnerability has been addressed in version 4.2.0.

References