CVE-2026-92151

Deferred Deferred - Pending Action

Svc::Ccsds::SpacePacketDeframer DoS in F´ Framework

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92151

EUVD

EUVD-2026-101462

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	fprime	< 4.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability is in the F Prime framework's SpacePacketDeframer component. The dataIn_handler function incorrectly treats a minimum packet length condition as a hard assertion (FW_ASSERT) rather than rejecting malformed packets. When a CCSDS telecommand frame results in a payload of six bytes or fewer after header and trailer removal, the assertion triggers, causing the flight software to abort or reset. This leads to a denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or resets in F Prime flight software processes, particularly when handling CCSDS telecommand frames with payloads of six bytes or fewer after header and trailer removal. Check system logs for FW_ASSERT failures or process aborts in Svc::Ccsds::SpacePacketDeframer. Use network monitoring tools to inspect incoming telecommand frames for malformed sizes that could trigger the issue.

Impact Analysis

An attacker could exploit this by sending a specially crafted telecommand frame that causes the flight software to crash or reset. This results in a denial of service, disrupting critical operations that depend on the F Prime framework. The impact is high severity due to the potential for complete loss of availability.

Compliance Impact

This vulnerability primarily causes denial of service by crashing flight software, which could impact systems handling sensitive data. However, the provided context does not directly link this issue to compliance with GDPR, HIPAA, or similar regulations.

Mitigation Strategies

Upgrade to F Prime version 4.2.0 or later to apply the fix. If upgrading is not immediately possible, modify the SpacePacketDeframer's dataIn_handler to replace the FW_ASSERT with proper error handling that logs and drops malformed packets instead of crashing. Ensure all telecommand frames are validated for minimum payload size before processing.

Hi! I’m here to help you understand CVE-2026-92151. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70