CVE-2026-92159 F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecvhandler fixed-slot copy TlmRecvhandler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime...

CVE-2026-92159 F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecvhandler fixed-slot copy TlmRecvhandler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime...

CVE-2026-92156

The F´ (F Prime) framework, used for spaceflight and embedded software, contains a vulnerability in Svc::EventManager 's loqQueue_internalInterfaceHandler packetization prior to version 4.3.0 . The EventManager accepts buffers up to the framework's LogBuffer maximum; however, because metadata (pa...

EUVD-2026-101408

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueueinternalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet...

CVE-2026-92156 F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueueinternalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet...

CVE-2026-92156 F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueueinternalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet...

CVE-2026-92157 F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrappe...

CVE-2026-92157

The F´ (F Prime) framework, used for spaceflight and embedded software applications, contains an integer overflow vulnerability in the Svc::FileDownlink SendPartial range validation prior to version 4.3.0 . The root cause is unchecked arithmetic where startOffset plus length can wrap around, resu...

EUVD-2026-101407

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrappe...

CVE-2026-92157 F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrappe...

CVE-2026-92152

The F´ (F Prime) framework, used for spaceflight and embedded software, contains an unvalidated port index vulnerability in Svc::GenericHub (versions 4.1.0 through 4.2.0). The root cause is the lack of an explicit range check on the deserialized port field when passed to functions like serialOut_...

CVE-2026-92152 F´: Unvalidated Port Index in GenericHub

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOutout, bufferOutout, eventOutout, or...

CVE-2026-92153 F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

CVE-2026-92153

The F´ (F Prime) framework, used for spaceflight and embedded software, contains an arbitrary file write vulnerability in Svc::FileUplink prior to version 4.3.0 . The root cause is that the system copies the destinationPath from Fw::FilePacket::StartPacket and opens it for writing without canonic...

CVE-2026-92153 F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

CVE-2026-92151 F´: SpacePacketDeframer Small Packet Assertion DoS

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataInhandler is vulnerable because the handler treats the minimum packet-length condition as FWASSERT rather than rejecting a...

CVE-2026-92151 F´: SpacePacketDeframer Small Packet Assertion DoS

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataInhandler is vulnerable because the handler treats the minimum packet-length condition as FWASSERT rather than rejecting a...

CVE-2026-92151

The F´ (F Prime) framework, used for spaceflight and embedded software applications, contains a vulnerability in the Svc::Ccsds::SpacePacketDeframer component prior to version 4.2.0 . The dataIn_handler incorrectly uses FW_ASSERT instead of rejecting the buffer when a CCSDS telecommand frame resu...

CVE-2026-92152: Improper Validation of Array Index

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOutout, bufferOutout, eventOutout, or...

PT-2026-114336

Name of the Vulnerable Software and Affected Versions F´ F Prime versions prior to 4.2.0 Description Svc::GenericHub fromBufferDriver handler deserialization is flawed because the receive handler uses FW ASSERT for type validation and deserialization status influenced by external sources, and...