F Prime EUVD-2026-101407

Exploitation requires: (1) an existing source file on the target larger than a valid startOffset; (2) a SendPartial command whose U32 sum of startOffset + length wraps around below the file size, producing a wrapped m_endOffset inconsistent with m_byteOffset; and (3) standard F Prime assertion handling (FW_ASSERT) configured to abort or reset the process on failure. Limiting factors: the attacker must be able to deliver the SendPartial command over the command interface (AV:A, adjacent - not internet-facing), a qualifying source file must already be present, and builds that disable FW_ASSERT abort behavior (e.g. NDEBUG no-op handling) may not experience the same process termination. No user interaction is required and the CVSS vector indicates no privileges (PR:N) at the framework level, though deployment command-authorization typically gates access.

This is a medium-severity, availability-only issue (CVSS 6.5, vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), scoped entirely to denial of service - C:N and I:N mean no data disclosure or tampering, only A:H from the integer-overflow-induced FW_ASSERT abort/reset. The attack vector is Adjacent (AV:A), not Network, so an attacker must reach the spacecraft/embedded command interface rather than exploit it across the open internet, and complexity is Low with no privileges or user interaction indicated (PR:N/UI:N). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis' - this is a patched defect, not an actively exploited one. Weighing the signals together: the deterministic U32 wrap makes exploitation technically reliable (consistent with AC:L), but the niche deployment footprint of a NASA spaceflight framework, the adjacent-only reach, and the DoS-only impact place this well below top-priority status for general IT fleets. In the specific context of flight software, however, an attacker-triggered process abort/reset can be operationally significant, so operators of F Prime deployments should patch to 4.3.0. Note the CVSS PR:N implies no authentication, but real-world command uplinks are typically access-controlled - treat PR:N as the mechanism-level truth within the base framework, while deployment-level command authorization usually limits who can send SendPartial.

An attacker with access to the F Prime command uplink sends a Svc::FileDownlink SendPartial command referencing an existing source file, supplying a startOffset plus a length whose U32 sum wraps below the file size. The wrapped m_endOffset passes range validation while being inconsistent with m_byteOffset, so at the first data-packet transition the inconsistency reaches FW_ASSERT and, under standard assertion handling, aborts or resets the process. No public exploit code is identified, but the overflow is deterministic and does not require authentication per the CVSS vector.