CVE-2026-92151: nasa fprime Reachable Assertion

Vulnerability summary

CVE-2026-92151 is a high (CVSS 7.5) Reachable Assertion vulnerability in nasa fprime. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.2% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.

• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.