CVE-2026-92152: nasa fprime Improper Validation of Array Index

Vulnerability summary

CVE-2026-92152 is a critical (CVSS 9.3) Improper Validation of Array Index vulnerability in nasa fprime. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.1% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.

• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.