CVE-2026-92159: F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecvhandler fixed-slot copy TlmRecvhandler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F´ (F Prime)to a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using F´ before version 4.3.0 that use Svc::TlmPacketizer are exposed when a configured telemetry channel receives a serialized value larger than that channel’s configured fixed storage slot.
What does an attacker need to exploit it?
An attacker needs a way to cause a telemetry update for a configured channel to carry an oversized serialized value. The supplied vector indicates adjacent-network attack access, low attack complexity, and no required privileges or user interaction.
Are default configurations affected?
The available information does not identify whether a default configuration includes affected TlmPacketizer channel sizing. Exposure depends on whether a configured channel can receive a value larger than its fixed slot.
What can be done before upgrading?
Ensure that serialized telemetry values cannot exceed the fixed slot size configured for their TlmPacketizer channels. Upgrade to F´ version 4.3.0 when possible.
How can I tell whether a deployment is affected?
Review TlmPacketizer channel configurations and compare each channel’s fixed storage size with the maximum serialized size of telemetry values it may receive. Corrupted packetized telemetry can indicate that an oversized value has overwritten adjacent channel fields.