CVE-2026-92155: F´: FileUplink Unknown Packet Type Assertion DoS
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FWASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F´ (F Prime)to a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
F Prime deployments using Svc::FileUplink and affected code before version 4.2.0 are exposed when they process network file packets. The default Ref application process can abort or reset.
What does an attacker need to send to trigger the issue?
An attacker needs to deliver a network file packet with an unknown file-packet type byte. No privileges or user interaction are required according to the supplied severity vector.
What should teams do if they cannot patch immediately?
The provided data identifies version 4.2.0 as the fix but does not specify an interim mitigation. Until upgrading, treat untrusted or malformed network file packets reaching FileUplink as a denial-of-service risk.