What is the CVSS score of CVE-2026-67977?

CVE-2026-67977 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-67977?

Within 24 hours, identify and inventory all systems operating fprime version 4.2.2 across flight software deployments and assess network exposure to untrusted remote sources. Within 7 days, implement network-based input filtering and intrusion detection signatures to detect and block malformed FileDownlink payloads; configure strict rate limiting on Svc::FileDownlink::SendPartial endpoints and enable comprehensive logging of all requests to this service component. Within 30 days, coordinate with NASA to evaluate fprime version upgrade paths, monitor official NASA fprime security advisories for patched releases such as fprime v4.3.0 or later, and assess feasibility of upgrading affected flight software systems.

fprime Framework CVE-2026-67977

EUVD-2026-52509 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-03 mitre

GHSA-9mrc-fpxj-w736

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable service exploitable without credentials; integer overflow produces only availability impact with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 20:23 vuln.today

CVSS changed

Aug 05, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.

AnalysisAI

Integer overflow in the Svc::FileDownlink::SendPartial component of NASA's fprime embedded flight software framework v4.2.2 allows unauthenticated remote attackers to crash the service via crafted input, resulting in a Denial of Service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special privileges are required, and a potential proof-of-concept is referenced at a public GitHub issue tracker. Despite the high CVSS score, EPSS sits at just 0.14% (4th percentile), and there is no CISA KEV listing, reflecting the niche aerospace deployment context of this framework.

Technical ContextAI

fprime (F Prime) is NASA's open-source C++ framework for embedded spaceflight software, used in flight system development across spacecraft and cubesat projects. The Svc::FileDownlink component manages the transmission of files from the embedded system to a ground station or connected receiver. The SendPartial method handles segmented file transfer operations. The reported CWE-400 (Uncontrolled Resource Consumption) in conjunction with an integer overflow (typically CWE-190) suggests that an arithmetic wraparound on a size or offset calculation within SendPartial - triggered by a specially crafted input value - causes the framework to enter an uncontrolled state leading to resource exhaustion or process termination. The CPE entry in NVD is listed as n/a, so no formal CPE string is assigned; the affected artifact is identified only by the upstream GitHub repository at github.com/nasa/fprime at version v4.2.2.

RemediationAI

No vendor-released patched version has been confirmed from the available data. The NVD entry references https://github.com/nasa/fprime, and a potential report exists at https://github.com/freedomfoxvare/cve/issues/1, but no corresponding upstream fix commit or tagged release has been independently verified. Organizations running fprime v4.2.2 should monitor the NASA fprime GitHub repository for patch releases. As a compensating control, restrict network access to the FileDownlink service using firewall rules or network segmentation to permit only trusted ground station IP ranges - this directly addresses the AV:N attack vector while the service remains unpatched. Additionally, input validation or rate-limiting wrappers on the SendPartial interface can reduce exposure. Note: restricting network access may affect legitimate telemetry downlink operations and should be coordinated with mission operations teams.