EUVD-2026-101310Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to inter-processor hub link
-
DeliverySend truncated buffer or invalid HubType
-
ExploitTrigger FW_ASSERT failure or size-subtraction underflow
-
ExecutionFlight-software process aborts or resets
-
ImpactDenial of service of embedded application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Requires a deployment using the Svc::GenericHub component for inter-processor/inter-component communication, and the attacker must be able to deliver frames onto that hub peer link (fromBufferDriver input). Triggering conditions are concrete: a buffer shorter than the 12-byte header (2×U32 + FwBuffSizeType), a HubType field >= HUB_TYPE_MAX, or a command-dispatch payload containing only a header - any of which fails an FW_ASSERT or underflows the payload-size subtraction. Limiting factors: exploitation is confined to systems that actually instantiate GenericHub and expose its link to untrusted or spoofable peers; in isolated or physically trusted inter-processor bus deployments the attack surface is effectively absent. No authentication is required on the hub peer (PR:N) and no user interaction is needed; impact is limited to availability (process abort/reset). |
| Impact | This is a genuine but bounded availability-only issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, C:N/I:N) scores 7.5 HIGH and is well-supported by the description and the confirming source diff: an unauthenticated peer on the inter-processor hub link can reliably crash the process with low complexity. However, the real-world risk is narrower than the 7.5 suggests. Impact is strictly denial of service (CWE-617 reachable assertion plus an unsigned size-subtraction underflow) with no confidentiality or integrity loss and no code execution. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation likelihood cannot be quantified from the data - status is best read as no public exploit identified at time of analysis. The 'network' attack vector is also somewhat generous: GenericHub is an inter-processor/inter-component transport within a flight-software deployment, so the realistic attacker must already reach the hub peer link rather than the open internet. Net: a real priority for F´-based systems where the hub is exposed to untrusted peers, but a high-CVSS/moderate-real-risk issue for typical isolated deployments. |
| Exploit ScenarioDerived | An attacker able to inject traffic onto an F´ GenericHub inter-processor link sends a deliberately truncated buffer, a buffer with a HubType value at or above HUB_TYPE_MAX, or a header-only command-dispatch payload. The receive handler's FW_ASSERT on the deserialization status/type fails (or the payload-size subtraction underflows), aborting or resetting the flight-software process. No public exploit code was identified in the provided data, but the diff in PR 4929 fully confirms the flawed code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Malformed inter-processor hub traffic can abort or reset NASA's F´ (F Prime) flight-software process in versions prior to 4.2.0, because the Svc::GenericHub receive handler treats externally supplied deserialization results as invariants and aborts via FW_ASSERT when they fail. An unauthenticated remote peer on a hub link (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) can send a truncated buffer, a HubType value at or above HUB_TYPE_MAX, or a header-only command-dispatch payload to trigger the fault, producing availability-only impact. The vendor has released 4.2.0 with hardened bounds and type checks; no public exploit code has been identified at time of analysis, and the issue is confined to deployments that genuinely instantiate GenericHub and expose its link to untrusted or spoofable peers.
RemediationAI
Upgrade to F Prime 4.2.0 or later, which is the vendor-released fix and is published at https://github.com/nasa/fprime/releases/tag/v4.2.0; the hardening changes are visible in PR https://github.com/nasa/fprime/pull/4929 and commit b56b53634fd4251ae84919f22dcff829ef9e0986, and the security advisory is https://github.com/nasa/fprime/security/advisories/GHSA-2mh6-f7jj-6c93. If upgrading cannot be performed immediately, apply compensating controls at the deployment boundary rather than relying on library behavior: terminate or bridge the hub link through a validating proxy that enforces the 12-byte minimum header, rejects HubType values >= HUB_TYPE_MAX, and rejects frames whose declared payload size does not equal the actual remaining buffer length (trade-off: adds a hop and latency to inter-processor traffic, and requires the proxy to be kept in sync with the hub protocol); or place GenericHub links only on physically trusted buses with no untrusted or spoofable peers (trade-off: removes remote-hub capability entirely and is impractical for multi-processor systems that legitimately share a link); or, where GenericHub is not required, exclude the component from the build (trade-off: loses all cross-processor command, telemetry, and event routing). Patch back-ports are also viable given the fix is self-contained to Svc/GenericHub/GenericHub.cpp, but any back-port must preserve all four checks (minimum length, HubType range, port validity/connection, and declared-size-versus-actual-size match), since omitting the size-equality check leaves the underflow reachable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
F´ (F Prime) is an open-source flight software and embedded systems framework from NASA/JPL, built around a component/port architecture with a custom serialization layer (Fw::SerializeBufferBase, Fw::ExternalSerializeBuffer, Fw::ComBuffer). Svc::GenericHub is the routing component that relays commands, telemetry, events, buffers, and command responses between processors over a hub link; its fromBufferDriver_handler() deserializes an inbound frame into a HubType discriminator, a port index, and a payload size before dispatching to the appropriate output port. CWE-617 (Reachable Assertion) is the root-cause class here: the handler validated deserialization status and the HubType range using FW_ASSERT, a construct intended to catch programming errors, not hostile input. Because the buffer contents are externally influenced by whatever peer writes to the hub link, an out-of-range type or a short read converts a recoverable parse error into a process abort/reset. The command-dispatch (HUB_TYPE_CMD_DISP) path additionally computed a payload wrapper size using an unsigned subtraction (rawSize - sizeof(U32)), which underflows when the frame contains only the 12-byte header (two U32 fields plus FwBuffSizeType), and the raw size check itself reloaded the reported size rather than the actual buffer contents. The upstream fix in PR #4929 replaces the asserts with returned FW_SERIALIZE_OK / FW_DESERIALIZE_SIZE_MISMATCH / FW_DESERIALIZE_INVALID_DATA statuses, adds a minimum-length check before any deserialization, validates HubType and the requested port against getNum_serialOut_OutputPorts()/isConnected_*, and confirms that the declared payload size matches the actual remaining buffer length before dispatch.
Know when Fprime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated hub peer sends malformed traffic over the inter-processor link (AV:N, PR:N, AC:L, UI:N); impact is a process crash only, so C:N/I:N and A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.
Technical POC Analysis
CWE-617 (Reachable Assertion).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
NASA’s F´ (F Prime) flight software, versions before 4.2.0, contains a high-severity availability flaw in Svc::GenericHub that can be triggered by an unauthenticated remote peer on an exposed hub link. Successful malformed traffic can abort or reset the flight-software process, disrupting missions or services that rely on those deployments, though impact is limited to systems that instantiate GenericHub and accept traffic from untrusted or spoofable peers. Leadership should prioritize inventory and patch because availability failures in flight or operational software can cause costly operational interruptions, even though no public exploit has been identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. Rated medium severity
Out-of-bounds array access in the Svc::GenericHub component of NASA's F´ (F Prime) framework (4.1.0 through 4.1.x, fixed
Integer overflow in NASA's F´ (F Prime) Svc::FileUplink component allows an operator with command-link access to bypass
Malformed CCSDS telecommand frames cause assertion-driven denial of service in NASA's F´ (F Prime) flight-software frame
Denial of service in NASA's F´ (F Prime) framework prior to 4.2.0 allows remote attackers to abort or reset the flight s
Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an au
Path traversal in F´ (F Prime) prior to 4.3.0 lets an authenticated peer on the file-uplink channel write or overwrite f
Denial of service through process abort and reset in NASA's F´ (F Prime) framework affects all versions prior to 4.3.0 w
Denial of service in NASA's F´ (F Prime) flight software framework prior to 4.3.0 allows an adjacent, unauthenticated at
Denial of service in NASA's F´ (F Prime) flight software framework before version 4.3.0, where an integer-overflow flaw
Corrupted packetized telemetry can be emitted by NASA's F´ (F Prime) flight and embedded software framework before versi
F Prime framework before version 4.2.0 allows remote code execution via integer overflow in bounds checking combined wit
Exploit-DB