CVE-2026-92159

MEDIUM 6.5

F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0.

CWE	CWE-130 CWE-805
Vendor	nasa
Product	fprime
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for nasa fprime

Be the first to know when new medium vulnerabilities affecting nasa fprime are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

nasa / fprime

< 4.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83 github.com: https://github.com/nasa/fprime/pull/4878 github.com: https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96 github.com: https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755 github.com: https://github.com/nasa/fprime/releases/tag/v4.3.0a1