CVE-2026-92155: CWE-617: Reachable Assertion in nasa fprime
Description
CVE-2026-92155 is a reachable assertion vulnerability in the NASA F Prime (fprime) framework prior to version 4.2.0. The vulnerability occurs during deserialization of file packets in the Svc::FileUplink component, where an invalid file-packet type byte causes an assertion failure. This results in the application process aborting or resetting, leading to a denial of service condition. The issue is resolved in version 4.2.0.
CVSS v3.1
Score 7.5high
Affected software
nasa
fprime
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
F Prime is a framework for spaceflight and embedded software applications. In versions before 4.2.0, the deserialization logic for Fw::FilePacket used by Svc::FileUplink casts a byte to the Type enum without validating if the byte is within the valid range. If a network file packet contains an unknown file-packet type byte, the FilePacket::fromSerialBuffer function triggers a default FW_ASSERT assertion failure. This assertion aborts or resets the default Ref application process, causing a denial of service. The vulnerability is identified as CWE-617 (Reachable Assertion) and has a CVSS 3.1 base score of 7.5 (high severity). The issue is fixed in version 4.2.0.
Potential Impact
An attacker can send a specially crafted network file packet with an invalid file-packet type byte, causing the application process to abort or reset due to an assertion failure. This results in a denial of service condition, disrupting the availability of the affected system. There is no impact on confidentiality or integrity according to the CVSS vector.
Mitigation Recommendations
Upgrade to F Prime version 4.2.0 or later, where this vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating the fix in version 4.2.0. No other mitigation is specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-15T17:13:57.865Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfbd8a2cdf04f6569a6b82
Added to database: 10/14/2026, 17:36:10 UTC
Last enriched: 10/14/2026, 17:48:16 UTC
Last updated: 10/14/2026, 17:50:37 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.