CVE-2026-92156: F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueueinternalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F´ (F Prime)to a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments that bridge events through GenericHub into Svc::EventManager are exposed when they can forward a legal Fw::LogBuffer larger than EventManager's remaining log-argument budget. The resulting serialization failure can abort or reset the process under standard F Prime assertion handling.
Does exploitation require authentication or user interaction?
No. The supplied vector lists adjacent-network access, low attack complexity, no privileges required, and no user interaction.
What is the remediation?
Upgrade to F Prime 4.3.0, which fixes the issue. The affected versions are those prior to 4.3.0.