Unrestricted Range Validation Flaw in NASA's F Prime Framework
CVE-2026-92157
What is CVE-2026-92157?
The F Prime framework, an innovative solution for developing spaceflight and embedded applications, possesses a range validation vulnerability prior to version 4.3.0. This issue arises in the Svc::FileDownlink SendPartial function, where insufficient validation allows for unchecked arithmetic on startOffset and length. Consequently, m_endOffset can wrap inappropriately, leading to inconsistencies with m_byteOffset. If a SendPartial command is executed with a length that, when added to a valid startOffset, wraps around the file size, it can trigger a denial of service through FW_ASSERT failure during data-packet transitions. This vulnerability has been resolved in version 4.3.0, emphasizing the importance of keeping software frameworks updated to mitigate such risks.
Affected Version(s)
fprime < 4.3.0