CVE-2026-92151

7.5High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-617

Impact

Remote, unauthenticated attackers can crash or reboot the flight-software process by sending a malformed telecommand frame, causing a denial of service. They only need network or radio uplink access capable of delivering CCSDS frames to the target system.

Root cause

The SpacePacketDeframer component uses an assertion (FW_ASSERT) instead of normal error-handling when encountering a packet payload of six bytes or fewer, causing an immediate process abort.

Affected systems

F´ (F Prime) versions prior to 4.2.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade to F´ version 4.2.0 or later. If upgrading immediately is not possible, filter incoming telecommand frames upstream or disable the affected uplink channel until the patch is deployed.

shell

$ git fetch --tags && git checkout v4.2.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-92151