CVE-2026-92150

Deferred Deferred - Pending Action

Denial of Service in F Prime Framework

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92150

EUVD

EUVD-2026-101310

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	fprime	< 4.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

CVE-2026-92150 is a high-severity vulnerability in F Prime versions up to v4.2.0a1. It affects the Svc::GenericHub fromBufferDriver_handler function where improper validation of deserialized data from untrusted network sources leads to reachable assertions that crash the flight software process. The flaw allows unauthenticated inter-processor communication channel access to trigger denial-of-service conditions through truncated buffers, invalid HubType values, or integer underflow during size calculation.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or resets in F Prime processes handling inter-processor communication. Check logs for assertion failures in Svc::GenericHub or processes using GenericHub.cpp. Monitor network traffic on inter-processor channels for truncated buffers, invalid HubType values, or header-only payloads. Use tools like tcpdump or Wireshark to inspect traffic for malformed packets targeting the GenericHub component.

Impact Analysis

This vulnerability can cause denial-of-service conditions for flight software by crashing the process when malformed network traffic is received. It requires network access to the inter-processor communication channel but no authentication, making it exploitable remotely. The crash results in system unavailability for critical operations.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions in flight software by crashing processes due to malformed network traffic. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged denial-of-service could disrupt critical operations, potentially affecting system availability required by these regulations.

Mitigation Strategies

Upgrade F Prime to version 4.2.0 or later to apply the patch that replaces hard asserts with proper validation. If upgrading is not immediately possible, implement network-level controls to restrict access to inter-processor communication channels. Add input validation in custom code to check buffer sizes and types before deserialization. Monitor for crashes or resets in GenericHub processes as potential exploitation attempts.

Hi! I’m here to help you understand CVE-2026-92150. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70