CVE-2026-92152

Deferred Deferred - Pending Action

Remote Code Execution in F Prime Framework

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92152

EUVD

EUVD-2026-101406

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	fprime	>= 4.1.0, < 4.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

CVE-2026-92152 is a vulnerability in the NASA F Prime framework's GenericHub component. It occurs when a remote hub packet supplies a port index outside the configured output-port array. The deserialized port field is passed directly to output functions without validation. In assert-enabled builds, this causes the process to abort. In builds without assertions, it leads to out-of-bounds heap access, heap corruption, and potential remote code execution.

Detection Guidance

To detect this vulnerability, monitor for crashes or aborts in F Prime applications using GenericHub, particularly when processing network packets. Check logs for FW_ASSERT failures or heap corruption errors. Inspect network traffic for malformed packets targeting GenericHub ports. Use tools like Wireshark to analyze F Prime protocol traffic for invalid port indices.

Impact Analysis

This vulnerability can impact users by causing denial of service (DoS) in debug builds due to process aborts. In release builds, it may corrupt heap memory and enable remote code execution by attackers sending malformed packets with invalid port indices.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling remote code execution or heap corruption through malformed packets. GDPR requires protection of personal data integrity, while HIPAA mandates secure handling of health data. A successful exploit could compromise system integrity, leading to unauthorized access or data breaches.

Mitigation Strategies

Upgrade F Prime to version 4.2.0 or later to apply the official fix. If upgrading is not possible, disable GenericHub network input or restrict network access to trusted sources only. Implement input validation at the network boundary to reject packets with port indices exceeding configured limits. Monitor system logs for signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-92152. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70