CVE-2026-92157: nasa fprime Integer Overflow or Wraparound

Vulnerability summary

CVE-2026-92157 is a medium (CVSS 6.5) Integer Overflow or Wraparound vulnerability in nasa fprime. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.9% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 20-10-2026
   Last modifiedVulnerability information updated.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.