Buffer Overflow Vulnerability in F Prime Framework

CVE-2026-92152

What is CVE-2026-92152?

The F Prime framework, used for developing spaceflight and embedded software applications, contains a buffer overflow vulnerability in versions 4.1.0 through 4.2.0. The issue arises from the deserialized port field being passed to various output functions without proper range checking. This flaw allows malicious remote packets to specify a port index that is outside the intended boundaries of the output-port array. In builds with assert enabled, this action triggers an abort; while in builds without assertions, it may lead to unauthorized access to memory, causing heap corruption and potentially paving the way for remote code execution. The vulnerability has been addressed in version 4.2.0.

References