CVE-2026-92154: F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F (F Prime)to a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges sufficient to send a file-uplink DATA packet to the affected Svc::FileUplink component. No user interaction is required, and the vulnerable interface is network-reachable according to the supplied severity vector.
What packet values are required to trigger the flaw?
The DATA packet must contain attacker-controlled byteOffset and dataSize values whose U32 unsigned addition wraps to a value below the declared file size. The component can then seek to the large supplied offset and write beyond the declared upload size.
What is the impact of successful exploitation?
Successful exploitation can compromise uploaded file integrity and write data beyond the declared file boundary. It can also create large sparse files or exhaust resources.
Which versions should be remediated?
F Prime versions prior to 4.2.0 are affected. Upgrade to version 4.2.0, which fixes the issue.