Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-92159F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry

Medium 6.5

In plain English

A medium-severity security flaw in fprime from nasa. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 61.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0.

Affected products (as reported)

Vendor	Product	Versions
nasa	fprime	< 4.3.0

Weakness: CWE-130, CWE-805 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83 x_refsource_CONFIRM
https://github.com/nasa/fprime/pull/4878 x_refsource_MISC
https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96 x_refsource_MISC
https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755 x_refsource_MISC
https://github.com/nasa/fprime/releases/tag/v4.3.0a1 x_refsource_MISC