CVE-2026-92160: F´: SendPartial Integer Overflow Leading to Assertion DoS
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes mendOffset, and leaves mbyteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a caller able to issue SendPartial supplies a length whose U32 sum with that offset wraps, the first data-packet send reaches FWASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F´ (F Prime)to a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
F Prime deployments prior to version 4.3.0 are affected when they use Svc::FileDownlink SendPartial and have an existing source file larger than the supplied startOffset. Exploitation also requires a caller that is able to issue SendPartial.
What input is required to trigger the failure?
The caller must provide a startOffset and length whose U32 sum wraps around. The wrapped value becomes the end offset while the byte offset remains greater than it, causing the first data-packet send to reach FW_ASSERT and abort or reset the process.
Is authentication or elevated access required?
The vulnerability requires low-privileged access: an attacker must be able to issue the SendPartial operation. No user interaction is required.
What is the remediation?
Upgrade to F Prime version 4.3.0, which fixes the issue. If upgrading is not immediately possible, restrict access to callers that can issue SendPartial and prevent untrusted callers from supplying startOffset and length values.