CVE-2026-92158
7.2HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-190, CWE-787
Impact
Authenticated attackers with sequence execution privileges can cause memory corruption, crash the service, and potentially execute arbitrary code. They need the ability to issue sequence-controlled STORE directives to Svc::FpySequencer.
Root cause
An integer overflow occurs when summing attacker-controlled offset and size during bounds checking, allowing out-of-bounds writes via memcpy.
Affected systems
F´ (F Prime) prior to 4.2.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to F´ version 4.2.0 or later. If patching immediately is not possible, restrict or disable sequence execution containing STORE directives targeting Svc::FpySequencer.
$ git -C fprime checkout v4.2.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.