File Integrity Vulnerability in F Prime Framework by NASA
CVE-2026-92154

8.1HIGH

Key Information:

Vendor

Nasa

Status
Fprime
Vendor
CVE Published:
14 October 2026

What is CVE-2026-92154?

The F Prime framework, designed for spaceflight and embedded software applications, has a vulnerability in the Svc::FileUplink component prior to version 4.2.0. This flaw arises when the framework improperly validates the byteOffset and dataSize during data packet processing. If the sum of these inputs wraps below the declared file size, it allows attackers to manipulate data writes, potentially leading to loss of file integrity and significant resource exhaustion through large sparse-file growth. This vulnerability has been addressed in version 4.2.0.

Affected Version(s)

fprime < 4.2.0

References

https://github.com/nasa/fprime/security/advisories/GHSA-w...
x_refsource_CONFIRM
https://github.com/nasa/fprime/pull/4919
x_refsource_MISC
https://github.com/nasa/fprime/commit/cacdd555456bd83ab39...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.