EUVD-2026-101409Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach TlmRecv telemetry input port (adjacent)
-
ExploitSend update for configured channel with oversized serialized value
-
ExecutionFixed-slot copy exceeds entry.channelSize bounds
-
ImpactAdjacent channel fields overwritten, corrupted packetized telemetry emitted
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Length parameter validation
|
| Exploitation Conditions | Exploitation requires a telemetry update delivered to the Svc::TlmPacketizer TlmRecv input port for a channel that is already configured in the packet list, where the serialized value's runtime size (val.getSize()) exceeds that channel's fixed slot size (entry.channelSize). The missing bounds check on this fixed-slot copy is the trigger. Limiting factors: the attacker needs adjacent-network reach to the telemetry path (AV:A, not internet-remote), the target channel must be configured/packetized, and the attacker must control or influence a telemetry source capable of emitting an oversized value for that channel; the outcome is corrupted telemetry only, with no code execution, data disclosure, or guaranteed crash. |
| Impact | This is a moderate-severity integrity flaw (CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) rather than a top-tier priority. The CVSS vector indicates adjacent-network, low-complexity, unauthenticated reach with no user interaction, but the impact is confined to integrity (I:H) - specifically corruption of packetized telemetry - with no confidentiality (C:N) and no availability (A:N) effect, and no privilege escalation or code execution claimed in the description. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit was supplied (the only GitHub source evidence is the vendor's fix/PR, not weaponized exploit code). Signals are therefore consistent and non-alarming: an unauthenticated adjacent attacker (or a misbehaving telemetry source) can corrupt emitted telemetry, which for a flight-software framework is operationally meaningful (operators could act on falsified telemetry), but it is not remote-internet-exploitable and does not grant control of the system. One nuance to verify with the vendor: PR:N combined with AV:A implies a telemetry source can reach the TlmRecv port without authentication, yet in practice triggering it requires a component wired to emit an oversized serialized value for a configured channel, which is closer to an internal wiring/trust-boundary condition than classic remote exploitation. |
| Exploit ScenarioDerived | An attacker with adjacent-network access to the telemetry path (or a compromised/misconfigured telemetry-source component) sends an update for a channel that is configured in the packet list but carries a serialized value larger than that channel's fixed slot. The TlmRecv_handler copies val.getSize() bytes into entry.channelSize storage without a bounds check, overwriting adjacent channel fields so the ground system receives corrupted, falsified packetized telemetry. No public exploit code is available; only the vendor fix is published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Corrupted packetized telemetry can be emitted by NASA's F´ (F Prime) flight and embedded software framework before version 4.3.0, because the Svc::TlmPacketizer component copies an incoming telemetry value into a fixed per-channel slot without verifying that the serialized value actually fits, allowing the copy to overrun adjacent channel fields inside the outgoing packet. The issue is rated CVSS 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning unauthenticated attackers with adjacent-network reach to the telemetry path, plus influence over a telemetry source feeding a already-configured channel, can corrupt packetized telemetry; there is no code execution, data disclosure, or guaranteed crash, and no public exploit code has been identified at time of analysis. The vendor fixed the flaw in version 4.3.0.
RemediationAI
Upgrade to F´ (F Prime) 4.3.0, which is the version the vendor identifies as containing the fix (vendor-released patch: 4.3.0). If an immediate framework upgrade is not possible, back-port the upstream change set instead: PR nasa/fprime#4878 with commits 048fe04062b91be7af138df7e09cdd15812dde96 and 7eacd551aaf6d9a21e347ac2c8d827ca15ee5755, which replace the by-value map copy with an index/reference-based m_channels lookup and reset m_numChannels, m_channelIndices and m_configured on reconfiguration; note that a partial back-port that only adds a size check without the reference-based storage change leaves the copy-then-reinsert pattern intact and is not equivalent. Compensating controls, in decreasing order of practicality: enforce on the telemetry source side that every channel's serialized value length never exceeds that channel's declared slot size, which is the true root cause but requires control over all producers and gives no protection against a misconfigured or malicious producer; restrict adjacent-network access to the telemetry input path (the AV:A vector means an attacker must already sit on the adjacent link), for example by segmenting or firewalling the telemetry transport, at the cost of added network complexity and potential loss of legitimate ground-station or test-bench connectivity; and reduce the number of configured/packetized channels or shrink packet lists so fewer adjacent slots are exposed to an overrun, accepting reduced telemetry coverage. Because the impact is corrupted telemetry rather than code execution, monitor emitted packets for field values that are inconsistent with channel definitions as a detection signal, and treat any unexplained packet corruption on configured channels as evidence of this issue. Advisory reference: https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
F´ (F Prime) is NASA's open-source flight software and embedded systems framework, in which components communicate over typed ports and telemetry channels are defined with fixed serialized sizes. The affected component, Svc::TlmPacketizer, accumulates configured telemetry channels into fixed-size slots and emits packetized telemetry frames; each channel entry carries a fixed channelSize used as the destination buffer for incoming updates. In the vulnerable code path, TlmRecv_handler performs a fixed-slot copy of val.getSize() bytes into entry.channelSize storage without confirming that the runtime serialized value is no larger than the slot, which is CWE-130 (Improper Handling of Length Parameter Inconsistency) - the declared/expected length and the actual runtime length are never reconciled. The upstream fix (PR nasa/fprime#4878, commits 048fe04062b91be7af138df7e09cdd15812dde96 and 7eacd551aaf6d9a21e347ac2c8d827ca15ee5755) reworks storage from a by-value map lookup that had to be re-inserted into an index-based m_channelIndices lookup returning references into m_channels, and resets m_numChannels, m_channelIndices and m_configured on reconfiguration so entries are updated in place rather than copied; the resulting writes stay within the intended entry rather than spilling into neighbouring channel frames. The practical consequence class is integrity of telemetry content only - memory corruption is confined to adjacent channel fields within the telemetry packet structure, not to arbitrary memory, and the assessed vector (AV:A, PR:N) puts the prerequisite on adjacent-network placement plus control of an oversized telemetry source rather than on any authentication bypass.
Know when Fprime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Telemetry arrives over adjacent component/bus links (AV:A) with no auth or interaction; the unchecked copy corrupts adjacent channel data giving I:H, while C:N and A:N since no disclosure or guaranteed crash is described.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. Rated medium severity
Out-of-bounds array access in the Svc::GenericHub component of NASA's F´ (F Prime) framework (4.1.0 through 4.1.x, fixed
Integer overflow in NASA's F´ (F Prime) Svc::FileUplink component allows an operator with command-link access to bypass
Malformed CCSDS telecommand frames cause assertion-driven denial of service in NASA's F´ (F Prime) flight-software frame
Malformed inter-processor hub traffic can abort or reset NASA's F´ (F Prime) flight-software process in versions prior t
Denial of service in NASA's F´ (F Prime) framework prior to 4.2.0 allows remote attackers to abort or reset the flight s
Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an au
Path traversal in F´ (F Prime) prior to 4.3.0 lets an authenticated peer on the file-uplink channel write or overwrite f
Denial of service through process abort and reset in NASA's F´ (F Prime) framework affects all versions prior to 4.3.0 w
Denial of service in NASA's F´ (F Prime) flight software framework prior to 4.3.0 allows an adjacent, unauthenticated at
Denial of service in NASA's F´ (F Prime) flight software framework before version 4.3.0, where an integer-overflow flaw
F Prime framework before version 4.2.0 allows remote code execution via integer overflow in bounds checking combined wit
Exploit-DB