Medium severity · published Oct 14, 2026
CVE-2026-92159
F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FP
fprime · nasa
< 4.3.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92159
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92159
x_refsource_CONFIRM
https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83
x_refsource_MISC
https://github.com/nasa/fprime/pull/4878
x_refsource_MISC
https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96
x_refsource_MISC
https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755
x_refsource_MISC
https://github.com/nasa/fprime/releases/tag/v4.3.0a1
More from fprime
9.8
CVE-2026-41144
F´ (F Prime) has Integer Overflow in FileUplink
9.8
CVE-2024-55028
A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file
9.8
CVE-2024-55030
A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands
9.3
CVE-2026-92152
F´: Unvalidated Port Index in GenericHub
8.1
CVE-2026-92154
F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation