CVE-2026-92150: CWE-617: Reachable Assertion in nasa fprime
Description
CVE-2026-92150 is a reachable assertion vulnerability in the nasa fprime framework prior to version 4.2.0. The issue arises in the Svc::GenericHub fromBufferDriver_handler deserialization process, where externally influenced deserialization status and type validation use FW_ASSERT, allowing a command payload size subtraction to underflow. An unauthenticated inter-processor hub peer can send malformed hub traffic such as truncated buffers, invalid HubType, or header-only command-dispatch payloads, causing the process to abort or reset and resulting in denial of service. This vulnerability is fixed in version 4.2.0.
CVSS v3.1
Score 7.5high
Affected software
nasa
fprime
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The nasa fprime framework versions before 4.2.0 contain a reachable assertion vulnerability (CWE-617) in the Svc::GenericHub fromBufferDriver_handler deserialization function. The vulnerability occurs because the receive handler uses FW_ASSERT on externally influenced deserialization status and type validation, which permits a command payload size subtraction to underflow. This allows an unauthenticated inter-processor hub peer to send malformed hub traffic—such as truncated buffers, invalid HubType values, or header-only command-dispatch payloads—that triggers an assertion failure, aborting or resetting the process and causing denial of service. The issue is resolved in version 4.2.0.
Potential Impact
An attacker who can send unauthenticated inter-processor hub traffic can cause the affected process to abort or reset by sending malformed or truncated command payloads. This results in a denial of service condition. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
This vulnerability is fixed in nasa fprime version 4.2.0. Users should upgrade to version 4.2.0 or later to remediate this issue. No other mitigation or workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-15T17:13:57.865Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfbd8a2cdf04f6569a6b7f
Added to database: 10/14/2026, 17:36:10 UTC
Last enriched: 10/14/2026, 17:48:26 UTC
Last updated: 10/14/2026, 19:00:32 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.