Denial of Service Vulnerability in F Prime Framework by NASA

CVE-2026-92155

What is CVE-2026-92155?

The F Prime framework, utilized in spaceflight and embedded software development, is susceptible to a denial of service attack due to improper deserialization of file packets. Specifically, the Header deserialization process within the Svc::FileUplink component fails to validate the range of the byte before casting it to the Type enum. This flaw leads to an assertion failure in the FilePacket::fromSerialBuffer method when it encounters an unknown file-packet type byte. As a result, this could cause the Ref application process to abort or reset, leading to service interruptions. This issue was addressed in version 4.2.0 of the framework.

References