F Prime CVE-2026-92155

Exploitation requires the target deployment to use Svc::FileUplink and process incoming network file packets through Fw::FilePacket deserialization; the attacker must be able to deliver a file packet containing a file-packet type byte outside the valid Type enum range. The CVSS vector lists PR:N (unauthenticated) and UI:N (no user interaction), but the practical limiting factor is reachability: the malicious packet must traverse the file-uplink/command path (in spaceflight contexts, the ground-to-vehicle uplink), so defenders who gate or authenticate that channel materially reduce exposure. Impact is limited to denial of service (process abort/reset of the Ref application) on versions prior to 4.2.0.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects an availability-only impact with no confidentiality or integrity loss - this is a pure denial-of-service via a reachable assertion (CWE-617), where an out-of-range file-packet type byte drives FilePacket::fromSerialBuffer into a FW_ASSERT that aborts or resets the Ref application process. The source-code evidence (PR #4919 replacing FW_ASSERT(0, status) with a FW_DESERIALIZE_INVALID_DATA return) confirms both the root cause and the fix. No EPSS score, CISA KEV listing, or public exploit was supplied in the intelligence set, so by the precision rules this is 'no public exploit identified at time of analysis.' While the vector is nominally network-reachable and unauthenticated, real-world exploitation requires the attacker to inject a crafted file packet into the Svc::FileUplink path - in a spaceflight/embedded deployment that typically means access to the command uplink/ground-link channel, which is a meaningful practical constraint not captured by AV:N. Net assessment: a legitimate availability bug worth patching, but closer to a moderate operational-robustness issue than an urgent internet-facing emergency, given the niche deployment footprint, DoS-only impact, and absence of any exploitation or POC signal.

An attacker with access to the spacecraft/application command uplink channel sends a file-uplink packet whose header contains a file-packet type byte outside the defined Type enum range. During deserialization the unknown type reaches a default FW_ASSERT, which aborts or resets the running Ref application, denying service until recovery. No public proof-of-concept was provided, and exploitation requires reaching the FileUplink data path rather than any default internet endpoint.