F Prime CVE-2026-92156

Exploitation requires a deployment that bridges events across address spaces through Svc::GenericHub into Svc::EventManager (the loqQueue_internalInterfaceHandler path) and forwards a legal Fw::LogBuffer whose size approaches the framework LogBuffer maximum. The trigger is that event metadata (packet descriptor, event identifier, time-tag) consumes part of the ComBuffer, leaving a smaller remaining budget for log arguments, so a maximum-size legal payload overflows that budget and fails serialization, reaching the standard F Prime FW_ASSERT. Limiting factors: this is NOT remotely exploitable against a default standalone configuration - it specifically depends on the GenericHub event-bridging topology (AV:A adjacent access), affects only fprime versions before 4.3.0, and under non-default assertion handling (if assertions are configured not to abort) the practical impact changes. Impact is limited to availability (process abort/reset); no code execution or data exposure.

This is a genuine but bounded availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates adjacent-network, low-complexity, unauthenticated impact limited purely to availability - consistent with CWE-131 (incorrect buffer size calculation) and the described assertion-driven abort/reset. There is no confidentiality or integrity impact and no scope change, so this cannot be chained into code execution or data theft from the data provided. No EPSS score, SSVC decision, KEV listing, or POC was supplied: exploitation status is therefore 'no public exploit identified at time of analysis,' and the absence of KEV/EPSS means there is no evidence of active or widespread exploitation. The AV:A rating is defensible because the vulnerable path specifically requires a GenericHub bridge from another address space rather than arbitrary internet reach, which materially narrows the realistic attacker population to those already on or adjacent to the spacecraft/embedded bus. Real-world priority is MODERATE and situational: it only matters for F Prime deployments that actually bridge events cross-domain via GenericHub, and the worst case is a process abort/reset (a DoS) on an embedded flight or avionics system where a reset can still be operationally significant.

In an F Prime deployment where events are bridged across address spaces through GenericHub into Svc::EventManager, an attacker (or a misbehaving bridged component) on the adjacent bus forwards a legal maximum-size Fw::LogBuffer whose log arguments exceed EventManager's remaining ComBuffer budget after packet-descriptor, event-ID, and time-tag metadata. Serialization then fails and reaches the standard F Prime FW_ASSERT, aborting or resetting the process and causing denial of service. No public proof-of-concept was provided, but the fixed PR diff and advisory precisely describe the triggering condition.