FileDownlink Vulnerability in F' Framework by NASA
CVE-2026-92160

6.5MEDIUM

Key Information:

Vendor

Nasa

Status
Fprime
Vendor
CVE Published:
14 October 2026

What is CVE-2026-92160?

The F' framework, utilized for the development and deployment of spaceflight and embedded software applications, contains a vulnerability in the SendPartial method of the Svc::FileDownlink class. This issue arises from insufficient validation of file ranges, allowing for an overflow condition when an offset is miscalculated. When a caller sends a length that, when added to a starting offset, results in an overflow, it leads to an assertion failure, potentially causing a denial of service by aborting or resetting the process. This vulnerability has been addressed in version 4.3.0 of the framework.

Affected Version(s)

fprime < 4.3.0

References

https://github.com/nasa/fprime/security/advisories/GHSA-8...
x_refsource_CONFIRM
https://github.com/nasa/fprime/pull/5565
x_refsource_MISC
https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.