F´ FpySequencer EUVD-2026-101411

Requires the attacker to supply and execute an F´ FpySequencer sequence containing a STORE directive whose stack offset and size, summed as U32, overflow so the destination bounds check is bypassed; this is a sequence-controlled code path, so the attacker must hold privileges to load/run sequences (PR:H - typically trusted command/uplink or ground-system authority). Affects only F´ versions prior to 4.2.0. Limiting factors: no public exploit exists, the high privilege requirement excludes unauthenticated attackers, and exploitation depends on the target actually running the FpySequencer component with the STORE directive reachable; no user interaction is required once a malicious sequence is executed.

This is a genuine but access-gated memory-corruption flaw rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) combines network reachability and low complexity with a HIGH privilege requirement - PR:H, meaning the attacker must already have authority to supply and run FpySequencer sequences, which on a spacecraft is a trusted command/uplink role. That privilege gate is the dominant risk-limiting factor and explains why this is High rather than Critical. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The underlying bug (CWE-190 integer wraparound: attacker-controlled offset+size summed as U32 before the bounds check, defeating validation ahead of memcpy) is a real, root-caused out-of-bounds write confirmed by the vendor advisory and the fixing PR/commit. Net: treat as a priority to patch for anyone running F´ with less-than-fully-trusted sequence sources, but the high-privilege prerequisite and absence of exploitation signals mean it is not an internet-facing wormable emergency.

An actor with authority to load and execute FpySequencer sequences (e.g., a compromised ground station or insider with command-uplink access) crafts a sequence containing a STORE directive whose stack offset and size sum to a value that wraps around in U32 arithmetic, so the pre-memcpy bounds check incorrectly passes. When the directive runs, memcpy writes outside the sequencer stack, corrupting adjacent memory to crash the flight software or potentially achieve code execution. No public exploit code is known; exploitation requires crafting the malicious sequence and the privilege to run it.