F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry
Summary
| CVE | CVE-2026-92159 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-14 18:19:35 UTC |
| Updated | 2026-10-14 18:19:35 UTC |
| Description | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from [email protected]
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Problem Types: CWE-130 | CWE-805 | CWE-130 CWE-130: Improper Handling of Length Parameter Inconsistency | CWE-805 CWE-805: Buffer Access with Incorrect Length Value
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | CNA | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
HighAvailability
NoneCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/nasa/fprime/releases/tag/v4.3.0a1 | [email protected] | github.com | |
| github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755 | [email protected] | github.com | |
| github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96 | [email protected] | github.com | |
| github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83 | [email protected] | github.com | |
| github.com/nasa/fprime/pull/4878 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.