CVE-2026-92155

Deferred Deferred - Pending Action

Fw::FilePacket Deserialization Flaw in F Prime Framework

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92155

EUVD

EUVD-2026-101313

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	fprime	< 4.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability is a Denial of Service (DoS) flaw in F Prime software versions before 4.2.0. It occurs when the Fw::FilePacket deserialization process in Svc::FileUplink fails to validate a byte before casting it to an enum type. This triggers an assertion failure, causing the application to crash or reset, disrupting normal operations.

Detection Guidance

Monitor for crashes or resets in F-Prime applications handling file uplinks. Check logs for FW_ASSERT(0) errors or SIGABRT signals during file packet processing. Inspect network traffic for malformed F-Prime frames with invalid file packet type bytes (outside 0-3 range).

Commands: Use tcpdump or Wireshark to capture F-Prime TCP traffic on default ports (e.g., tcp.port==27000). Check application logs for assertion failures. Verify F-Prime version with fprime-cli --version or inspect build metadata.

Impact Analysis

An attacker could exploit this by sending a specially crafted network packet to a vulnerable system. This would cause the application to crash, leading to service disruption or downtime. The attack requires no authentication and can be executed with a single packet over the network.

Compliance Impact

This vulnerability could lead to service unavailability, which may violate availability requirements in GDPR and HIPAA. Downtime could disrupt critical operations, potentially causing compliance breaches if systems fail to meet uptime or data accessibility standards.

Mitigation Strategies

Upgrade F-Prime to version 4.2.0 or later to address the deserialization flaw. If upgrading is not immediately possible, disable the Svc::FileUplink component in the deployment configuration to prevent file packet processing.

Apply network-level mitigations: restrict access to F-Prime TCP ports via firewalls, use VPNs for remote access, and monitor for suspicious traffic patterns targeting file uplink services.

Hi! I’m here to help you understand CVE-2026-92155. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70