Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

F Prime GenericHub can run out‑of‑bounds code

CVE-2026-92152 · published 4 days ago
Summary

Versions 4.1.0 through 4.2.0 of the F Prime framework's GenericHub component may accept an invalid port number from a remote packet. If the number is outside the expected range, the software can write beyond its memory area, potentially corrupting data or allowing an attacker to run their own code. Update to version 4.2.0 or later to fix the problem.

Original advisory text
F´: Unvalidated Port Index in GenericHub
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-129Improper Validation of Array Index
Timeline
Published14 Oct 2026
Updated16 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-92152 · NVD
CVE-2026-92152 · OSV
GHSA-vv4x-5pmf-m59g · GHSA
Track software like this
Free during beta