CVE-2026-92158: F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F´ (F Prime)to a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
F Prime deployments using versions prior to 4.2.0 are affected where Svc::FpySequencer processes sequence-controlled STORE directives. Version 4.2.0 contains the fix.
What does an attacker need to exploit the vulnerability?
An attacker needs the ability to supply or control a sequence containing a STORE directive. The directive must provide stack offset and size values whose U32 addition wraps around.
What is the impact of successful exploitation?
A wrapped bounds check can allow memcpy to write outside the sequencer stack. This can cause memory corruption and denial of service, and may potentially allow code execution.
What should be done if patching cannot happen immediately?
Restrict who can supply or modify sequences processed by Svc::FpySequencer, particularly sequences containing STORE directives. Avoid processing untrusted sequence content until the deployment can be updated to 4.2.0.