EUVD-2026-101418Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain file-uplink command authority
-
DeliverySend crafted DATA packet with wrapping offset+size
-
ExploitBypass U32 bounds validation
-
ExecutionSeek to attacker-controlled offset and write
-
ImpactCorrupt file integrity / exhaust storage
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to deliver a FileUplink DATA packet to the Svc::FileUplink component - i.e., command/uplink authority to the F´-based system (reflected as PR:L) - and that the FileUplink component be deployed and actively processing uplinked files. The specific trigger is a DATA packet whose byteOffset and dataSize are set so their unsigned U32 sum wraps below the declared file size, passing the pre-fix offset+size check. Limiting factors: an attacker must hold command-link access and the privileges to issue file-uplink commands; systems not running FileUplink, running version 4.2.0 or later, or whose command link is isolated/authenticated are not exploitable. No user interaction is required once uplink access exists. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) indicates a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with high integrity and availability impact and no confidentiality impact - consistent with CWE-190 integer overflow corrupting file writes and exhausting storage. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The real-world risk is moderated by context: PR:L reflects that an attacker must be able to inject file-uplink DATA packets into Svc::FileUplink, which in F´ deployments means authority over the spacecraft/embedded command uplink - a link that is typically closed, authenticated, and not Internet-exposed, making the AV:N rating technically correct but operationally narrow. CAVEAT: CVSS encodes AV:N, but the uplink path for a flight-software framework is rarely a public network - defenders should verify whether their command link is reachable by untrusted parties before treating this as remotely exploitable. This is a legitimate integrity/availability concern for systems actually running FileUplink, but it is not a mass-exploitation Internet threat; priority should be scaled to deployment exposure rather than the raw 8.1 score. |
| Exploit ScenarioDerived | An actor with access to the command/file-uplink link sends a crafted FileUplink DATA packet whose byteOffset and dataSize are chosen so their unsigned U32 sum wraps below the declared file size, defeating the bounds check; the component then seeks to the large attacker-controlled offset and writes, corrupting file integrity and triggering large sparse-file growth or storage exhaustion. Given AV:N/AC:L, the packet is simple to construct once uplink access is available, but PR:L means command authority is required. No public proof-of-concept is referenced in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Integer overflow in NASA's F´ (F Prime) Svc::FileUplink component allows an operator with command-link access to bypass the declared upload-size check and write file data beyond the intended boundary, corrupting file integrity and enabling large sparse-file growth or storage/resource exhaustion. The flaw affects releases prior to 4.2.0 and is reachable by any attacker who can deliver a crafted DATA packet carrying a byteOffset and dataSize whose unsigned U32 sum wraps below the declared file size; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) reflects network reachability, low complexity, low privileges, no user interaction, high integrity and availability impact, and no confidentiality impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV); the vendor-released fix is version 4.2.0.
RemediationAI
Vendor-released patch: 4.2.0 - upgrade F´ (F Prime) deployments to version 4.2.0 or later, applying the changes in https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798 (PR https://github.com/nasa/fprime/pull/4919) and reviewed in the advisory https://github.com/nasa/fprime/security/advisories/GHSA-wx8q-q5gx-f54p. If the flight build cannot be rebaselined immediately, the most effective compensating control is to remove or disable the Svc::FileUplink instance from the deployment topology, which fully closes the attack path at the cost of losing ground-to-spacecraft file uplink until the patch is flown; a narrower alternative is to restrict access to the uplink command interface so only trusted, authenticated ground operators with file-uplink authority can send DATA packets (trade-off: added operational friction and dependence on the integrity of the command-link authentication and isolation). Because the flaw yields oversized or sparse files, operators can also cap the damage by enforcing filesystem quotas or size limits on the storage partition used for uplinked files and by monitoring FileUplink activity, file-size telemetry, and warning/event logs for uploads whose written length diverges from the declared file size - these are detection and containment measures only, not substitutes for the 4.2.0 update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
F´ (F Prime) is NASA's open-source flight-software framework for spaceflight and other embedded applications, organized as modular components communicating over ports; Svc::FileUplink is the ground-to-spacecraft file transfer component that consumes FilePacket DATA packets to reconstruct an uplinked file. The root cause is CWE-190 (integer overflow or wraparound): prior to 4.2.0, handleDataPacket validated a packet by adding byteOffset and dataSize using wrapping U32 arithmetic and comparing the result against the declared file size. When the sum wraps (for example to a small value), the check passes even though the true offset-plus-length extends far past the declared size, after which the component seeks to the attacker-controlled offset and writes the payload, producing out-of-bounds writes relative to the declared upload, sparse-file expansion, and potential resource exhaustion. The affected CPE is cpe:2.3:a:nasa:fprime:*:*:*:*:*:*:*:*. The fix in the 4.2.0 codebase is broader input-validation hardening: Fw/FilePacket/FilePacket.cpp replaces a fatal FW_ASSERT on malformed buffers with a new FW_DESERIALIZE_INVALID_DATA status, and PR #4919 similarly converts hard assertions in the CCSDS SpacePacketDeframer and TcDeframer into logged, packet-dropping error paths (adding InvalidPacket events and a new SP_INVALID_PACKET frame-error code) and replaces FileDownlink filename assertions with length guards and overflow events - i.e., malformed uplink/downlink input is now rejected rather than trusted.
Know when Fprime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Reachable over the command uplink (AV:N) with a simple crafted packet (AC:L) but requires file-uplink command authority (PR:L); impact is file corruption (I:H) and storage exhaustion (A:H) with no data disclosure (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.
Technical POC Analysis
CWE-190 (Integer Overflow or Wraparound).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
NASA's F´ (F Prime) flight software framework, used across mission ground and flight systems, contains a high-severity flaw in its file-uplink component that allows an operator with command-link access to corrupt uploaded files or exhaust onboard storage. The defect harms file integrity and availability but not confidentiality, so the primary organizational risk is disruption to mission operations and data handling rather than data exposure. Leadership should prioritize upgrading affected deployments to version 4.2.0, since exploitation requires only low privileges and no user interaction.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. Rated medium severity
Out-of-bounds array access in the Svc::GenericHub component of NASA's F´ (F Prime) framework (4.1.0 through 4.1.x, fixed
Malformed CCSDS telecommand frames cause assertion-driven denial of service in NASA's F´ (F Prime) flight-software frame
Malformed inter-processor hub traffic can abort or reset NASA's F´ (F Prime) flight-software process in versions prior t
Denial of service in NASA's F´ (F Prime) framework prior to 4.2.0 allows remote attackers to abort or reset the flight s
Memory corruption in NASA's F´ (F Prime) FpySequencer component, affecting framework versions prior to 4.2.0, lets an au
Path traversal in F´ (F Prime) prior to 4.3.0 lets an authenticated peer on the file-uplink channel write or overwrite f
Denial of service through process abort and reset in NASA's F´ (F Prime) framework affects all versions prior to 4.3.0 w
Denial of service in NASA's F´ (F Prime) flight software framework prior to 4.3.0 allows an adjacent, unauthenticated at
Denial of service in NASA's F´ (F Prime) flight software framework before version 4.3.0, where an integer-overflow flaw
Corrupted packetized telemetry can be emitted by NASA's F´ (F Prime) flight and embedded software framework before versi
F Prime framework before version 4.2.0 allows remote code execution via integer overflow in bounds checking combined wit
Exploit-DB