CVE-2026-92157: F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped mendOffset that is inconsistent with mbyteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FWASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F´ (F Prime)to a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to denial of service?
Deployments using F Prime versions before 4.3.0 are affected when FileDownlink can process a SendPartial command against an existing source file larger than the supplied startOffset. Under standard F Prime assertion handling, exploitation can abort or reset the process.
What does an attacker need to trigger the issue?
An attacker needs to send a SendPartial command with a legal startOffset and a length that causes the U32 sum of startOffset and length to wrap below the source file size. No privileges or user interaction are required according to the supplied vector.
Is a configuration change required for the denial of service to occur?
The described impact occurs under standard F Prime assertion handling. The vulnerable condition is in SendPartial range validation, so it depends on FileDownlink handling the crafted command and an appropriate existing source file.
What version resolves the issue?
F Prime 4.3.0 fixes the unchecked startOffset plus length arithmetic that permits the range-check bypass.