Stack Overflow Vulnerability in F Prime Framework by NASA

CVE-2026-92158

What is CVE-2026-92158?

The F Prime framework is susceptible to a vulnerability related to the Svc::FpySequencer STORE directive due to insufficient stack write validations. An attacker can manipulate the stack offset and size parameters, resulting in an integer wraparound during memory operations. This can allow memcpy to write beyond the boundaries of the sequencer’s stack, leading to potential memory corruption and service disruption, and, in some cases, could enable code execution. This vulnerability has been addressed in version 4.2.0, making it crucial for users to update to this version to protect against these risks.

References