F Prime (F´) EUVD-2026-101317

Exploitation requires all of: (1) a caller with authority to issue the Svc::FileDownlink SendPartial command (PR:L - not anonymous); (2) an existing on-board source file whose size is larger than the supplied startOffset; and (3) a SendPartial length value whose unsigned 32-bit (U32) sum with startOffset arithmetically wraps around, so the wrapped end offset passes range validation while leaving m_byteOffset greater than it. Limiting factors: the command-authority requirement means this is reachable only by an authorized or compromised commanding entity, not an unauthenticated network attacker, and only F´ builds prior to 4.3.0 that use the FileDownlink partial-send feature are affected. Impact is limited to a process abort/reset (availability only).

This is a moderate-severity denial-of-service issue, not a critical priority. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 with the impact confined entirely to availability (C:N/I:N) - no code execution or data exposure, consistent with the CWE-190 integer-overflow-to-FW_ASSERT abort described. The attack vector is marked network (AV:N) but PR:L confirms the attacker must already be an authorized caller able to issue the SendPartial command, which in an F´ deployment means holding command/uplink authority rather than being an anonymous internet attacker - this materially constrains real-world risk. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis; the signals are therefore internally consistent (moderate CVSS, availability-only, privilege-gated) rather than conflicting. The practical concern is that triggering it requires only a specific arithmetic condition (a length whose U32 sum with the offset wraps), making it easy to hit for anyone who already has command access, but the privilege precondition keeps this well below the urgency of an unauthenticated RCE.

An operator or compromised ground-segment entity with authority to issue the Svc::FileDownlink SendPartial command targets an on-board source file that is larger than the supplied startOffset, then provides a length value whose unsigned 32-bit sum with that offset wraps around. The crafted sum bypasses file-range validation and is stored as m_endOffset, so the first data-packet send hits FW_ASSERT and aborts or resets the flight-software process, denying the downlink service. No public exploit code was identified at time of analysis.