Search
Find a vulnerability
Search criteria
174 vulnerabilities by NASA
CVE-2026-111125 (GCVE-0-2026-111125)
Vulnerability from nvd – Published: 2026-10-15 18:57 – Updated: 2026-10-21 01:15
VLAI
EPSS
VEX
Title
CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble
Summary
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 01:15 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/cfitsio-zdither0-dit… | technical-descriptionexploit |
| https://github.com/HEASARC/cfitsio/blob/d6d276537… | technical-description |
| https://github.com/HEASARC/cfitsio/blob/d6d276537… | technical-description |
| https://github.com/HEASARC/cfitsio | product |
| https://www.vulncheck.com/advisories/cfitsio-thro… | third-party-advisory |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111125",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T01:15:11.834733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:15:29.785Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"product": "cfitsio",
"repo": "https://github.com/HEASARC/cfitsio",
"vendor": "HEASARC",
"versions": [
{
"lessThanOrEqual": "4.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:22.035Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/fits_hdecompress.c#L2575-L2633"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L6310-L6316"
},
{
"tags": [
"product"
],
"url": "https://github.com/HEASARC/cfitsio"
},
{
"name": "VulnCheck Advisory: CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-hcompress-input-nnybble"
}
],
"title": "CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111125",
"datePublished": "2026-10-15T18:57:22.035Z",
"dateReserved": "2026-10-15T17:03:51.157Z",
"dateUpdated": "2026-10-21T01:15:29.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111124 (GCVE-0-2026-111124)
Vulnerability from nvd – Published: 2026-10-15 18:57 – Updated: 2026-10-26 15:02
VLAI
EPSS
VEX
Title
CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed
Summary
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:02 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/cfitsio-zdither0-dit… | technical-description |
| https://github.com/HEASARC/cfitsio/blob/d6d276537… | technical-description |
| https://github.com/HEASARC/cfitsio/blob/d6d276537… | technical-description |
| https://github.com/HEASARC/cfitsio | product |
| https://www.vulncheck.com/advisories/cfitsio-thro… | third-party-advisory |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111124",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:02:01.055497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:02:09.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"product": "cfitsio",
"repo": "https://github.com/HEASARC/cfitsio",
"vendor": "HEASARC",
"versions": [
{
"lessThanOrEqual": "4.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:21.328Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L5353-L5362"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L7495-L7516"
},
{
"tags": [
"product"
],
"url": "https://github.com/HEASARC/cfitsio"
},
{
"name": "VulnCheck Advisory: CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-negative-zdither0-seed"
}
],
"title": "CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111124",
"datePublished": "2026-10-15T18:57:21.328Z",
"dateReserved": "2026-10-15T17:03:50.803Z",
"dateUpdated": "2026-10-26T15:02:09.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92160 (GCVE-0-2026-92160)
Vulnerability from nvd – Published: 2026-10-14 17:20 – Updated: 2026-10-15 15:07
VLAI
EPSS
VEX
Title
F´: SendPartial Integer Overflow Leading to Assertion DoS
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes m_endOffset, and leaves m_byteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a caller able to issue SendPartial supplies a length whose U32 sum with that offset wraps, the first data-packet send reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:52 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/5565 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/33fe2a4fe3f… | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/95eeb5cfb44… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:52:11.338963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:07:20.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes m_endOffset, and leaves m_byteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a caller able to issue SendPartial supplies a length whose U32 sum with that offset wraps, the first data-packet send reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:20:36.334Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-8r3j-ghrh-55mw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-8r3j-ghrh-55mw"
},
{
"name": "https://github.com/nasa/fprime/pull/5565",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/5565"
},
{
"name": "https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14985669fbad09f070e9914",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14985669fbad09f070e9914"
},
{
"name": "https://github.com/nasa/fprime/commit/95eeb5cfb44e5609eff0887f0e11e640cdacef6b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/95eeb5cfb44e5609eff0887f0e11e640cdacef6b"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0"
}
],
"source": {
"advisory": "GHSA-8r3j-ghrh-55mw",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: SendPartial Integer Overflow Leading to Assertion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92160",
"datePublished": "2026-10-14T17:20:36.334Z",
"dateReserved": "2026-09-15T17:13:57.866Z",
"dateUpdated": "2026-10-15T15:07:20.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92159 (GCVE-0-2026-92159)
Vulnerability from nvd – Published: 2026-10-14 17:12 – Updated: 2026-10-15 18:56
VLAI
EPSS
VEX
Title
F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:56 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4878 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/048fe04062b… | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/7eacd551aaf… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0a1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92159",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:56:18.426514Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:56:42.827Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130: Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-805",
"description": "CWE-805: Buffer Access with Incorrect Length Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:12:47.065Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83"
},
{
"name": "https://github.com/nasa/fprime/pull/4878",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4878"
},
{
"name": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96"
},
{
"name": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0a1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0a1"
}
],
"source": {
"advisory": "GHSA-grrq-8rmr-xf83",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92159",
"datePublished": "2026-10-14T17:12:47.065Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T18:56:42.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92158 (GCVE-0-2026-92158)
Vulnerability from nvd – Published: 2026-10-14 17:14 – Updated: 2026-10-14 17:14
VLAI
EPSS
VEX
Title
F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.
Severity
7.2 (High)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4534 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/7527430d9ae… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:14:17.994Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-vfwv-3qv7-jjjq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-vfwv-3qv7-jjjq"
},
{
"name": "https://github.com/nasa/fprime/pull/4534",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4534"
},
{
"name": "https://github.com/nasa/fprime/commit/7527430d9ae7c88f3d649d376a45c866b0aed595",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/7527430d9ae7c88f3d649d376a45c866b0aed595"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-vfwv-3qv7-jjjq",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92158",
"datePublished": "2026-10-14T17:14:17.994Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-14T17:14:17.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92157 (GCVE-0-2026-92157)
Vulnerability from nvd – Published: 2026-10-14 17:09 – Updated: 2026-10-20 01:42
VLAI
EPSS
VEX
Title
F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:42 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/5565 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/33fe2a4fe3f… | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/95eeb5cfb44… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92157",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:42:03.567016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:42:27.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-hcmw-g425-8h9g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:09:20.199Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-hcmw-g425-8h9g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-hcmw-g425-8h9g"
},
{
"name": "https://github.com/nasa/fprime/pull/5565",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/5565"
},
{
"name": "https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14985669fbad09f070e9914",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14985669fbad09f070e9914"
},
{
"name": "https://github.com/nasa/fprime/commit/95eeb5cfb44e5609eff0887f0e11e640cdacef6b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/95eeb5cfb44e5609eff0887f0e11e640cdacef6b"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0"
}
],
"source": {
"advisory": "GHSA-hcmw-g425-8h9g",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92157",
"datePublished": "2026-10-14T17:09:20.199Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-20T01:42:27.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92156 (GCVE-0-2026-92156)
Vulnerability from nvd – Published: 2026-10-14 17:10 – Updated: 2026-10-14 17:52
VLAI
EPSS
VEX
Title
F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:50 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/5633 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/7eacd551aaf… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92156",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:50:45.621287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:52:06.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "CWE-131: Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:10:13.076Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7"
},
{
"name": "https://github.com/nasa/fprime/pull/5633",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/5633"
},
{
"name": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0"
}
],
"source": {
"advisory": "GHSA-6fxx-mgfv-55g7",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92156",
"datePublished": "2026-10-14T17:10:13.076Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-14T17:52:06.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92155 (GCVE-0-2026-92155)
Vulnerability from nvd – Published: 2026-10-14 17:19 – Updated: 2026-10-15 15:07
VLAI
EPSS
VEX
Title
F´: FileUplink Unknown Packet Type Assertion DoS
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:55 UTC
CWE
- CWE-617 - Reachable Assertion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4919 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/cacdd555456… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:55:52.938459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:07:29.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:19:20.560Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-3534-8qg7-6cf5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-3534-8qg7-6cf5"
},
{
"name": "https://github.com/nasa/fprime/pull/4919",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4919"
},
{
"name": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-3534-8qg7-6cf5",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: FileUplink Unknown Packet Type Assertion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92155",
"datePublished": "2026-10-14T17:19:20.560Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T15:07:29.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92154 (GCVE-0-2026-92154)
Vulnerability from nvd – Published: 2026-10-14 17:17 – Updated: 2026-10-15 18:55
VLAI
EPSS
VEX
Title
F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:54 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4919 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/cacdd555456… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92154",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:54:50.578904Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:55:39.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-wx8q-q5gx-f54p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:17:20.331Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-wx8q-q5gx-f54p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-wx8q-q5gx-f54p"
},
{
"name": "https://github.com/nasa/fprime/pull/4919",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4919"
},
{
"name": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"
}
],
"source": {
"advisory": "GHSA-wx8q-q5gx-f54p",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92154",
"datePublished": "2026-10-14T17:17:20.331Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T18:55:39.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92152 (GCVE-0-2026-92152)
Vulnerability from nvd – Published: 2026-10-14 17:08 – Updated: 2026-10-14 17:08
VLAI
EPSS
VEX
Title
F´: Unvalidated Port Index in GenericHub
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.
Severity
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4929 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/b56b53634fd… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:08:25.371Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-vv4x-5pmf-m59g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-vv4x-5pmf-m59g"
},
{
"name": "https://github.com/nasa/fprime/pull/4929",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4929"
},
{
"name": "https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-vv4x-5pmf-m59g",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: Unvalidated Port Index in GenericHub"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92152",
"datePublished": "2026-10-14T17:08:25.371Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-14T17:08:25.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92150 (GCVE-0-2026-92150)
Vulnerability from nvd – Published: 2026-10-14 17:18 – Updated: 2026-10-20 01:43
VLAI
EPSS
VEX
Title
F´: GenericHub Malformed Buffer Assertion DoS
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:43 UTC
CWE
- CWE-617 - Reachable Assertion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4929 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/b56b53634fd… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92150",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:43:05.787918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:43:37.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:18:29.342Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93"
},
{
"name": "https://github.com/nasa/fprime/pull/4929",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4929"
},
{
"name": "https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-2mh6-f7jj-6c93",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: GenericHub Malformed Buffer Assertion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92150",
"datePublished": "2026-10-14T17:18:29.342Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-20T01:43:37.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92153 (GCVE-0-2026-92153)
Vulnerability from nvd – Published: 2026-10-14 16:28 – Updated: 2026-10-15 15:07
VLAI
EPSS
VEX
Title
F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:52 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/5320 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/4c8b9c0b869… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:52:12.083583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:07:36.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:28:18.673Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-5rfj-hw2g-vwmv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-5rfj-hw2g-vwmv"
},
{
"name": "https://github.com/nasa/fprime/pull/5320",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/5320"
},
{
"name": "https://github.com/nasa/fprime/commit/4c8b9c0b8692b0d47cbd5f2ccec61c74aa02b893",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/4c8b9c0b8692b0d47cbd5f2ccec61c74aa02b893"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0"
}
],
"source": {
"advisory": "GHSA-5rfj-hw2g-vwmv",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92153",
"datePublished": "2026-10-14T16:28:18.673Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T15:07:36.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92151 (GCVE-0-2026-92151)
Vulnerability from nvd – Published: 2026-10-14 16:26 – Updated: 2026-10-15 18:57
VLAI
EPSS
VEX
Title
F´: SpacePacketDeframer Small Packet Assertion DoS
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:57 UTC
CWE
- CWE-617 - Reachable Assertion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4919 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/cacdd555456… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92151",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:57:05.604770Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:20.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-4rjh-jqvx-r8j5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:26:08.976Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-4rjh-jqvx-r8j5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-4rjh-jqvx-r8j5"
},
{
"name": "https://github.com/nasa/fprime/pull/4919",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4919"
},
{
"name": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-4rjh-jqvx-r8j5",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: SpacePacketDeframer Small Packet Assertion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92151",
"datePublished": "2026-10-14T16:26:08.976Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T18:57:20.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105164 (GCVE-0-2026-105164)
Vulnerability from nvd – Published: 2026-10-04 22:00 – Updated: 2026-10-25 06:42
VLAI
EPSS
VEX
Title
NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds
Summary
A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 15:06 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413396 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/413396/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105164 | third-party-advisory |
| https://vuldb.com/submit/969930 | third-party-advisory |
| https://github.com/nasa/cFS/issues/893 | issue-tracking |
| https://github.com/nasa/cFS/pull/984 | issue-trackingpatch |
| https://github.com/nasa/cFS/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105164",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T15:06:04.239300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T15:31:08.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nasa:cfs:*:*:*:*:*:*:*:*"
],
"product": "cFS",
"vendor": "NASA",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kontantinus Rivaldi Hormat"
},
{
"lang": "en",
"type": "reporter",
"value": "juntheworld (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "Rivaldi Hormat (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:N/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T06:42:36.843Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413396 | NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/413396"
},
{
"name": "VDB-413396 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413396/cti"
},
{
"name": "CVE-2026-105164 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105164"
},
{
"name": "Submit #969930 | NASA Core Flight System / cFE 7.0.1 Heap-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/969930"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/nasa/cFS/issues/893"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/nasa/cFS/pull/984"
},
{
"tags": [
"product"
],
"url": "https://github.com/nasa/cFS/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T07:44:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105164",
"datePublished": "2026-10-04T22:00:13.811Z",
"dateReserved": "2026-10-04T07:57:06.622Z",
"dateUpdated": "2026-10-25T06:42:36.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79954 (GCVE-0-2026-79954)
Vulnerability from nvd – Published: 2026-09-18 00:26 – Updated: 2026-09-18 19:58
VLAI
EPSS
VEX
Title
NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID
Summary
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:58 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
Fluid Attacks
CNA
References
2 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/linkin | third-party-advisory |
| https://github.com/nasa/CryptoLib | product |
Impacted products
Date Public
2026-09-18 00:11
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79954",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:58:38.011606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:58:55.144Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "CryptoLib",
"vendor": "NASA",
"versions": [
{
"status": "affected",
"version": "1.5.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nasa:cryptolib:1.5.0:*:windows:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nasa:cryptolib:1.5.0:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nasa:cryptolib:1.5.0:*:macos:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Romel Mar\u00edn"
}
],
"datePublic": "2026-09-18T00:11:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eNASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame\u0027s GVCID.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame\u0027s GVCID."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T00:26:28.854Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/linkin"
},
{
"tags": [
"product"
],
"url": "https://github.com/nasa/CryptoLib"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2026-79954",
"datePublished": "2026-09-18T00:26:28.854Z",
"dateReserved": "2026-08-25T15:27:48.157Z",
"dateUpdated": "2026-09-18T19:58:55.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111125 (GCVE-0-2026-111125)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-21 01:15
VLAI
EPSS
VEX
Title
CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble
Summary
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 01:15 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/cfitsio-zdither0-dit… | technical-descriptionexploit |
| https://github.com/HEASARC/cfitsio/blob/d6d276537… | technical-description |
| https://github.com/HEASARC/cfitsio/blob/d6d276537… | technical-description |
| https://github.com/HEASARC/cfitsio | product |
| https://www.vulncheck.com/advisories/cfitsio-thro… | third-party-advisory |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111125",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T01:15:11.834733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:15:29.785Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"product": "cfitsio",
"repo": "https://github.com/HEASARC/cfitsio",
"vendor": "HEASARC",
"versions": [
{
"lessThanOrEqual": "4.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:22.035Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/fits_hdecompress.c#L2575-L2633"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L6310-L6316"
},
{
"tags": [
"product"
],
"url": "https://github.com/HEASARC/cfitsio"
},
{
"name": "VulnCheck Advisory: CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-hcompress-input-nnybble"
}
],
"title": "CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111125",
"datePublished": "2026-10-15T18:57:22.035Z",
"dateReserved": "2026-10-15T17:03:51.157Z",
"dateUpdated": "2026-10-21T01:15:29.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111124 (GCVE-0-2026-111124)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-26 15:02
VLAI
EPSS
VEX
Title
CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed
Summary
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:02 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/cfitsio-zdither0-dit… | technical-description |
| https://github.com/HEASARC/cfitsio/blob/d6d276537… | technical-description |
| https://github.com/HEASARC/cfitsio/blob/d6d276537… | technical-description |
| https://github.com/HEASARC/cfitsio | product |
| https://www.vulncheck.com/advisories/cfitsio-thro… | third-party-advisory |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111124",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:02:01.055497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:02:09.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"product": "cfitsio",
"repo": "https://github.com/HEASARC/cfitsio",
"vendor": "HEASARC",
"versions": [
{
"lessThanOrEqual": "4.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:21.328Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L5353-L5362"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L7495-L7516"
},
{
"tags": [
"product"
],
"url": "https://github.com/HEASARC/cfitsio"
},
{
"name": "VulnCheck Advisory: CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-negative-zdither0-seed"
}
],
"title": "CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111124",
"datePublished": "2026-10-15T18:57:21.328Z",
"dateReserved": "2026-10-15T17:03:50.803Z",
"dateUpdated": "2026-10-26T15:02:09.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92160 (GCVE-0-2026-92160)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:20 – Updated: 2026-10-15 15:07
VLAI
EPSS
VEX
Title
F´: SendPartial Integer Overflow Leading to Assertion DoS
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes m_endOffset, and leaves m_byteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a caller able to issue SendPartial supplies a length whose U32 sum with that offset wraps, the first data-packet send reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:52 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/5565 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/33fe2a4fe3f… | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/95eeb5cfb44… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:52:11.338963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:07:20.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes m_endOffset, and leaves m_byteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a caller able to issue SendPartial supplies a length whose U32 sum with that offset wraps, the first data-packet send reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:20:36.334Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-8r3j-ghrh-55mw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-8r3j-ghrh-55mw"
},
{
"name": "https://github.com/nasa/fprime/pull/5565",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/5565"
},
{
"name": "https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14985669fbad09f070e9914",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14985669fbad09f070e9914"
},
{
"name": "https://github.com/nasa/fprime/commit/95eeb5cfb44e5609eff0887f0e11e640cdacef6b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/95eeb5cfb44e5609eff0887f0e11e640cdacef6b"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0"
}
],
"source": {
"advisory": "GHSA-8r3j-ghrh-55mw",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: SendPartial Integer Overflow Leading to Assertion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92160",
"datePublished": "2026-10-14T17:20:36.334Z",
"dateReserved": "2026-09-15T17:13:57.866Z",
"dateUpdated": "2026-10-15T15:07:20.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92155 (GCVE-0-2026-92155)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:19 – Updated: 2026-10-15 15:07
VLAI
EPSS
VEX
Title
F´: FileUplink Unknown Packet Type Assertion DoS
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:55 UTC
CWE
- CWE-617 - Reachable Assertion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4919 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/cacdd555456… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:55:52.938459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:07:29.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:19:20.560Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-3534-8qg7-6cf5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-3534-8qg7-6cf5"
},
{
"name": "https://github.com/nasa/fprime/pull/4919",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4919"
},
{
"name": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-3534-8qg7-6cf5",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: FileUplink Unknown Packet Type Assertion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92155",
"datePublished": "2026-10-14T17:19:20.560Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T15:07:29.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92150 (GCVE-0-2026-92150)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:18 – Updated: 2026-10-20 01:43
VLAI
EPSS
VEX
Title
F´: GenericHub Malformed Buffer Assertion DoS
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:43 UTC
CWE
- CWE-617 - Reachable Assertion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4929 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/b56b53634fd… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92150",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:43:05.787918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:43:37.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:18:29.342Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93"
},
{
"name": "https://github.com/nasa/fprime/pull/4929",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4929"
},
{
"name": "https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-2mh6-f7jj-6c93",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: GenericHub Malformed Buffer Assertion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92150",
"datePublished": "2026-10-14T17:18:29.342Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-20T01:43:37.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92154 (GCVE-0-2026-92154)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:17 – Updated: 2026-10-15 18:55
VLAI
EPSS
VEX
Title
F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:54 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4919 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/cacdd555456… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92154",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:54:50.578904Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:55:39.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-wx8q-q5gx-f54p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:17:20.331Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-wx8q-q5gx-f54p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-wx8q-q5gx-f54p"
},
{
"name": "https://github.com/nasa/fprime/pull/4919",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4919"
},
{
"name": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"
}
],
"source": {
"advisory": "GHSA-wx8q-q5gx-f54p",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92154",
"datePublished": "2026-10-14T17:17:20.331Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T18:55:39.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92158 (GCVE-0-2026-92158)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:14 – Updated: 2026-10-14 17:14
VLAI
EPSS
VEX
Title
F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.
Severity
7.2 (High)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4534 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/7527430d9ae… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:14:17.994Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-vfwv-3qv7-jjjq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-vfwv-3qv7-jjjq"
},
{
"name": "https://github.com/nasa/fprime/pull/4534",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4534"
},
{
"name": "https://github.com/nasa/fprime/commit/7527430d9ae7c88f3d649d376a45c866b0aed595",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/7527430d9ae7c88f3d649d376a45c866b0aed595"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-vfwv-3qv7-jjjq",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92158",
"datePublished": "2026-10-14T17:14:17.994Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-14T17:14:17.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92159 (GCVE-0-2026-92159)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:12 – Updated: 2026-10-15 18:56
VLAI
EPSS
VEX
Title
F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:56 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4878 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/048fe04062b… | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/7eacd551aaf… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0a1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92159",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:56:18.426514Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:56:42.827Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130: Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-805",
"description": "CWE-805: Buffer Access with Incorrect Length Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:12:47.065Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83"
},
{
"name": "https://github.com/nasa/fprime/pull/4878",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4878"
},
{
"name": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96"
},
{
"name": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0a1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0a1"
}
],
"source": {
"advisory": "GHSA-grrq-8rmr-xf83",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92159",
"datePublished": "2026-10-14T17:12:47.065Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T18:56:42.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92156 (GCVE-0-2026-92156)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:10 – Updated: 2026-10-14 17:52
VLAI
EPSS
VEX
Title
F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:50 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/5633 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/7eacd551aaf… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92156",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:50:45.621287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:52:06.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "CWE-131: Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:10:13.076Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7"
},
{
"name": "https://github.com/nasa/fprime/pull/5633",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/5633"
},
{
"name": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0"
}
],
"source": {
"advisory": "GHSA-6fxx-mgfv-55g7",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92156",
"datePublished": "2026-10-14T17:10:13.076Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-14T17:52:06.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92157 (GCVE-0-2026-92157)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:09 – Updated: 2026-10-20 01:42
VLAI
EPSS
VEX
Title
F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:42 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/5565 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/33fe2a4fe3f… | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/95eeb5cfb44… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92157",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:42:03.567016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:42:27.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-hcmw-g425-8h9g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:09:20.199Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-hcmw-g425-8h9g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-hcmw-g425-8h9g"
},
{
"name": "https://github.com/nasa/fprime/pull/5565",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/5565"
},
{
"name": "https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14985669fbad09f070e9914",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/33fe2a4fe3fd5ff1b14985669fbad09f070e9914"
},
{
"name": "https://github.com/nasa/fprime/commit/95eeb5cfb44e5609eff0887f0e11e640cdacef6b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/95eeb5cfb44e5609eff0887f0e11e640cdacef6b"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0"
}
],
"source": {
"advisory": "GHSA-hcmw-g425-8h9g",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92157",
"datePublished": "2026-10-14T17:09:20.199Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-20T01:42:27.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92152 (GCVE-0-2026-92152)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:08 – Updated: 2026-10-14 17:08
VLAI
EPSS
VEX
Title
F´: Unvalidated Port Index in GenericHub
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.
Severity
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4929 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/b56b53634fd… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:08:25.371Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-vv4x-5pmf-m59g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-vv4x-5pmf-m59g"
},
{
"name": "https://github.com/nasa/fprime/pull/4929",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4929"
},
{
"name": "https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-vv4x-5pmf-m59g",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: Unvalidated Port Index in GenericHub"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92152",
"datePublished": "2026-10-14T17:08:25.371Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-14T17:08:25.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92153 (GCVE-0-2026-92153)
Vulnerability from cvelistv5 – Published: 2026-10-14 16:28 – Updated: 2026-10-15 15:07
VLAI
EPSS
VEX
Title
F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:52 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/5320 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/4c8b9c0b869… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.3.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:52:12.083583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:07:36.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:28:18.673Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-5rfj-hw2g-vwmv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-5rfj-hw2g-vwmv"
},
{
"name": "https://github.com/nasa/fprime/pull/5320",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/5320"
},
{
"name": "https://github.com/nasa/fprime/commit/4c8b9c0b8692b0d47cbd5f2ccec61c74aa02b893",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/4c8b9c0b8692b0d47cbd5f2ccec61c74aa02b893"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.3.0"
}
],
"source": {
"advisory": "GHSA-5rfj-hw2g-vwmv",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92153",
"datePublished": "2026-10-14T16:28:18.673Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T15:07:36.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92151 (GCVE-0-2026-92151)
Vulnerability from cvelistv5 – Published: 2026-10-14 16:26 – Updated: 2026-10-15 18:57
VLAI
EPSS
VEX
Title
F´: SpacePacketDeframer Small Packet Assertion DoS
Summary
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:57 UTC
CWE
- CWE-617 - Reachable Assertion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nasa/fprime/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/nasa/fprime/pull/4919 | x_refsource_MISC |
| https://github.com/nasa/fprime/commit/cacdd555456… | x_refsource_MISC |
| https://github.com/nasa/fprime/releases/tag/v4.2.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92151",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:57:05.604770Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:20.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-4rjh-jqvx-r8j5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fprime",
"vendor": "nasa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:26:08.976Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nasa/fprime/security/advisories/GHSA-4rjh-jqvx-r8j5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nasa/fprime/security/advisories/GHSA-4rjh-jqvx-r8j5"
},
{
"name": "https://github.com/nasa/fprime/pull/4919",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/pull/4919"
},
{
"name": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"
},
{
"name": "https://github.com/nasa/fprime/releases/tag/v4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nasa/fprime/releases/tag/v4.2.0"
}
],
"source": {
"advisory": "GHSA-4rjh-jqvx-r8j5",
"discovery": "UNKNOWN"
},
"title": "F\u00b4: SpacePacketDeframer Small Packet Assertion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-92151",
"datePublished": "2026-10-14T16:26:08.976Z",
"dateReserved": "2026-09-15T17:13:57.865Z",
"dateUpdated": "2026-10-15T18:57:20.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105164 (GCVE-0-2026-105164)
Vulnerability from cvelistv5 – Published: 2026-10-04 22:00 – Updated: 2026-10-25 06:42
VLAI
EPSS
VEX
Title
NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds
Summary
A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 15:06 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/413396 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/413396/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-105164 | third-party-advisory |
| https://vuldb.com/submit/969930 | third-party-advisory |
| https://github.com/nasa/cFS/issues/893 | issue-tracking |
| https://github.com/nasa/cFS/pull/984 | issue-trackingpatch |
| https://github.com/nasa/cFS/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105164",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T15:06:04.239300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T15:31:08.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nasa:cfs:*:*:*:*:*:*:*:*"
],
"product": "cFS",
"vendor": "NASA",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kontantinus Rivaldi Hormat"
},
{
"lang": "en",
"type": "reporter",
"value": "juntheworld (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "Rivaldi Hormat (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:N/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T06:42:36.843Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-413396 | NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/413396"
},
{
"name": "VDB-413396 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/413396/cti"
},
{
"name": "CVE-2026-105164 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-105164"
},
{
"name": "Submit #969930 | NASA Core Flight System / cFE 7.0.1 Heap-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/969930"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/nasa/cFS/issues/893"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/nasa/cFS/pull/984"
},
{
"tags": [
"product"
],
"url": "https://github.com/nasa/cFS/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T07:44:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-105164",
"datePublished": "2026-10-04T22:00:13.811Z",
"dateReserved": "2026-10-04T07:57:06.622Z",
"dateUpdated": "2026-10-25T06:42:36.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79954 (GCVE-0-2026-79954)
Vulnerability from cvelistv5 – Published: 2026-09-18 00:26 – Updated: 2026-09-18 19:58
VLAI
EPSS
VEX
Title
NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID
Summary
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:58 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
Fluid Attacks
CNA
References
2 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/linkin | third-party-advisory |
| https://github.com/nasa/CryptoLib | product |
Impacted products
Date Public
2026-09-18 00:11
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79954",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:58:38.011606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:58:55.144Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"MacOS"
],
"product": "CryptoLib",
"vendor": "NASA",
"versions": [
{
"status": "affected",
"version": "1.5.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nasa:cryptolib:1.5.0:*:windows:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nasa:cryptolib:1.5.0:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nasa:cryptolib:1.5.0:*:macos:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Romel Mar\u00edn"
}
],
"datePublic": "2026-09-18T00:11:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eNASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame\u0027s GVCID.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame\u0027s GVCID."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T00:26:28.854Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/linkin"
},
{
"tags": [
"product"
],
"url": "https://github.com/nasa/CryptoLib"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2026-79954",
"datePublished": "2026-09-18T00:26:28.854Z",
"dateReserved": "2026-08-25T15:27:48.157Z",
"dateUpdated": "2026-09-18T19:58:55.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}