CVE-2026-92151: F´: SpacePacketDeframer Small Packet Assertion DoS
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataInhandler is vulnerable because the handler treats the minimum packet-length condition as FWASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F´ (F Prime)to a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
F Prime versions prior to 4.2.0 are affected when they use Svc::Ccsds::SpacePacketDeframer to process CCSDS telecommand frames. The vulnerable path is reached after TcDeframer removes the frame header and trailer.
What does an attacker need to send to trigger the failure?
An attacker must be able to provide a CCSDS telecommand frame that leaves a payload of six bytes or fewer after TcDeframer processing. No privileges or user interaction are required according to the supplied vector.
What is the operational impact of a successful trigger?
The small payload condition invokes FW_ASSERT instead of rejecting the packet and returning the buffer. This can abort or reset the flight-software process, causing a denial of service.
What version resolves the issue?
The issue is fixed in F Prime version 4.2.0. No alternative mitigation is provided in the available data.