F Prime (F´) EUVD-2026-101462

Exploitation requires the target flight software to use the Svc::Ccsds deframer chain (TcDeframer feeding SpacePacketDeframer) and the attacker to inject a CCSDS telecommand frame onto the command/data-link path such that, after TcDeframer removes the TC header and trailer, the remaining payload is six bytes or fewer (i.e., buffer size at or below SpacePacketHeader::SERIALIZED_SIZE). No authentication within the framework and no user interaction are needed (PR:N/UI:N) - the deframer performs no cryptographic validation before the assertion. The principal LIMITING factor is access to the spacecraft telecommand uplink/ground-link interface, which is not generally internet-exposed; exploitation is also limited to versions prior to 4.2.0 and to topologies that actually instantiate these CCSDS components.

This is a CWE-617 reachable-assertion denial of service in NASA's F´ (F Prime) flight-software framework. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with high availability impact and no confidentiality/integrity impact - fully consistent with the description: an undersized CCSDS frame reaches an FW_ASSERT that aborts or resets the flight-software process. The signals are largely coherent, with one nuance worth flagging: the CVSS vector marks PR:N and AV:N, but 'network' here means the spacecraft telecommand/data-link path, and reaching the deframer requires the attacker to inject frames onto that command uplink - an access barrier that CVSS does not model and that materially lowers real-world exploitability for most deployments. No EPSS score, KEV entry, or POC flag was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' Although the fix is a trivial size check and the triggering condition (a payload of six bytes or fewer) is simple to reproduce for anyone with link access, there is no evidence of active exploitation or widespread targeting. Net: a legitimate, patch-worthy availability bug for F´ operators, but not an internet-mass-exploitation priority given both the specialized attack surface and the DoS-only impact.

An attacker with access to a spacecraft's CCSDS telecommand uplink transmits a malformed telecommand frame whose payload is six bytes or fewer after the TcDeframer strips its header and trailer. When this undersized buffer reaches Svc::Ccsds::SpacePacketDeframer::dataIn_handler, the minimum-length FW_ASSERT fires, aborting or resetting the flight-software process and denying command processing. No public exploit code was identified in the provided data, but the triggering condition is simple and the fix diff publicly documents the exact vulnerable check.