CVE-2026-92157

Deferred Deferred - Pending Action

Svc::FileDownlink Partial Range Wrap in F Prime

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92157

EUVD

EUVD-2026-101407

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	fprime	< 4.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow issue in the FileDownlink component of the NASA F Prime framework. It occurs in the SendPartial function where unchecked 32-bit unsigned integer arithmetic allows crafted startOffset and length values to bypass range validation. When startOffset plus length wraps around due to exceeding the maximum U32 value, it sets an inconsistent m_endOffset that triggers an assertion failure during data packet processing, causing a denial of service.

Detection Guidance

This vulnerability is specific to the FileDownlink component in F Prime versions prior to 4.3.0. Detection requires checking the F Prime version in use and monitoring for assertion failures or process resets during FileDownlink operations. No direct network or system commands are provided in the context to detect this issue.

Impact Analysis

An attacker with access to the command interface could send a single SendPartial request to crash the F Prime process, disrupting file retrieval and automated workflows. This causes denial of service but does not directly impact confidentiality or integrity of data.

Compliance Impact

This vulnerability primarily causes denial of service by crashing the F Prime process through assertion failures, which could disrupt automated workflows and file retrieval operations. It does not directly impact confidentiality or integrity of data, so its impact on compliance with standards like GDPR or HIPAA is likely indirect, such as potential disruptions to data processing or availability.

Mitigation Strategies

Upgrade F Prime to version 4.3.0 or later to address the vulnerability directly.
Restrict access to the SendPartial command if upgrading is not immediately possible.
Implement input validation with non-wrapping arithmetic for startOffset and length parameters.
Disable partial-file downlink functionality if it is not required for operations.

Hi! I’m here to help you understand CVE-2026-92157. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70