CVE-2026-92156

Deferred Deferred - Pending Action

EventManager Log Argument Buffer Overflow in F Prime Framework

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92156

EUVD

EUVD-2026-101408

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	fprime	< 4.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

Executive Summary

This vulnerability in the NASA F Prime framework (CVE-2026-92156) involves EventManager crashing when processing a legal but oversized Fw::LogBuffer event payload. The issue occurs because EventManager's packet format has a smaller capacity (495 bytes) than the maximum allowed Fw::LogBuffer (506 bytes) after accounting for packet metadata overhead. When a remote event is bridged via GenericHub into EventManager, the oversized payload triggers an assertion failure during serialization, causing a denial-of-service by resetting or aborting the process.

Detection Guidance

Detecting this vulnerability requires checking F Prime framework versions and monitoring for assertion failures or crashes in EventManager. Verify if your deployment uses Svc::GenericHub bridging events to Svc::EventManager. Check logs for EventManager assertion failures or process resets when handling large Fw::LogBuffer payloads. No specific commands are provided in the resources, but monitoring for crashes or assertion errors in EventManager logs is recommended.

Impact Analysis

This vulnerability can cause a denial-of-service (DoS) by crashing or resetting the F Prime deployment when it receives a legal but oversized event payload through the GenericHub event bridge. This may terminate critical processes, disrupt operations, or require manual intervention to restart the system. The impact is most severe for deployments using GenericHub to bridge remote events into EventManager, especially in lower-trust network environments.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) conditions by crashing F Prime deployments when processing legal but oversized event payloads. While not directly violating GDPR or HIPAA, such crashes could disrupt systems handling sensitive data, potentially leading to unauthorized access or data breaches during recovery. Compliance risks arise indirectly if the DoS interrupts logging, monitoring, or security controls required by these regulations.

Mitigation Strategies

Upgrade to F Prime version 4.3.0 or later to apply the patch. If upgrading is not immediately possible, enforce a 495-byte limit on bridged event arguments or avoid using the GenericHub-to-EventManager remote-event bridge with lower-trust peers. Monitor for crashes or assertion failures in EventManager as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-92156. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70