CVE-2026-92152: F´: Unvalidated Port Index in GenericHub
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOutout, bufferOutout, eventOutout, or tlmOutout without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using F Prime versions from 4.1.0 up to, but not including, 4.2.0 are affected when they use Svc::GenericHub output-port dispatch and receive remote hub packets.
What must an attacker be able to do to exploit it?
An attacker needs to be able to supply a remote hub packet containing an out-of-range deserialized port index. The vulnerable dispatch path passes that index to GenericHub output methods without an explicit range check.
What is the impact in assertion-enabled versus assertion-disabled builds?
Assertion-enabled builds abort when an invalid output-port index is used. Builds without assertions may access the output-port array out of bounds, corrupt heap memory, and could permit remote code execution.
What version fixes the vulnerability?
Upgrade to F Prime 4.2.0, which includes the fix.