F Prime Framework CVE-2026-41144

F Prime is a NASA-developed framework for embedded systems and spaceflight software. The vulnerability exists in the file upload validation logic (Svc/FileUplink/File.cpp), where a U32 integer overflow in the bounds check (byteOffset + dataSize > fileSize) allows validation bypass when the sum wraps past 32-bit boundaries. The root cause is improper integer overflow handling (CWE-190: Integer Overflow or Wraparound) combined with insufficient input validation on file paths. When byteOffset=0xFFFFFF9C (4,294,967,196 in decimal) and dataSize=100, the sum wraps to 100 in the U32 space, bypassing a check intended to prevent writes beyond the file boundary. The absence of path sanitization in the DataPacket handler (CWE-22 Path Traversal) allows the attacker to specify arbitrary destination file paths, enabling writes to system-critical files. The logic error evades standard memory sanitization tools (ASAN) because all actual memory accesses remain within valid buffer bounds-the corruption manifests in the file I/O layer itself.