CVE-2026-92154 in F Prime
Summary
by MITRE • 10/14/2026
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The F Prime framework serves as a critical infrastructure for developing and deploying embedded software applications within spaceflight systems and other high-reliability environments. These systems often rely on robust file management components to handle data ingestion, including firmware updates or telemetry uploads via mechanisms like the FileUplink component. The security of these operations is paramount because any compromise in file integrity can lead to catastrophic failures in mission-critical hardware. Prior to version 4.2.0, a significant vulnerability existed within the Svc::FileUplink implementation that undermined the integrity guarantees expected by operators and automated systems relying on this framework for secure data transfer.
The core technical flaw resides in how the component validates input parameters before performing file operations. Specifically, when processing DATA packets, the code calculates whether the target write location is valid by adding the byteOffset to the dataSize using unsigned 32-bit integer arithmetic. This calculation suffers from a classic integer overflow vulnerability where the sum wraps around if it exceeds the maximum value representable by a U32 type. Instead of detecting this wrap-around as an error condition, the flawed logic proceeds under the assumption that the resulting wrapped value is within acceptable bounds relative to the file size. Consequently, when the component subsequently seeks to the attacker-controlled offset and writes data, it does not account for the fact that the initial validation check was bypassed by the arithmetic overflow.
This vulnerability allows an adversary who can inject or manipulate DATA packets during a file upload process to write data beyond the declared boundaries of the target file. By carefully crafting byteOffset and dataSize values such their unsigned sum wraps below the actual file size, the attacker forces the system to seek to a location that was not validated as safe in the context of the total intended transfer. This results in writing data at arbitrary offsets within or potentially outside the allocated file structure, depending on how the underlying filesystem handles sparse writes and seeks beyond current end-of-file markers. The immediate operational impact includes severe file integrity loss, where critical configuration files or firmware images become corrupted due to unauthorized overwrites of existing content with attacker-controlled payloads.
Beyond simple corruption, this flaw can lead to significant resource exhaustion issues. If the seek operation targets a location far beyond the current end of the file without proper truncation or allocation limits, it may trigger the creation of large sparse files on disk. In embedded systems with limited storage capacity, such as those found in satellites or remote sensors, rapidly expanding file sizes can exhaust available disk space, leading to denial-of-service conditions where the system becomes unresponsive or crashes due to resource constraints. This vector effectively transforms a data integrity issue into a potential availability attack against critical infrastructure components that rely on predictable storage behavior.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write. The failure to properly validate arithmetic results before memory or file access operations is a common pattern in embedded C/C++ codebases where performance optimization sometimes supersedes rigorous bounds checking. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques related to Defense Evasion through data manipulation and potentially Impact via resource exhaustion. Attackers could leverage this flaw to persist malicious configurations or disrupt mission operations by degrading system stability.
The issue was addressed in version 4.2.0 of the F Prime framework by implementing stricter validation logic that correctly handles unsigned integer arithmetic boundaries. Developers upgrading from earlier versions must ensure they apply this patch to restore secure file handling behaviors. Mitigation strategies for organizations still running older versions include restricting network access to FileUplink interfaces, validating packet structures at higher-level protocol layers before they reach the vulnerable component, and implementing strict size limits on uploaded files regardless of internal arithmetic checks. Regular security audits focusing on integer overflow patterns in embedded C code are recommended to identify similar latent defects across other components within the F Prime ecosystem or comparable frameworks used in aerospace and industrial control systems.