CVE-2026-92160 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.3.0. The flaw occurs in the Svc::FileDownlink SendPartial function where a wrapping sum bypasses file-range validation, causing the process to abort or reset and resulting in denial of service. This issue is fixed in version 4.3.0.
F Prime (F´) is a framework for spaceflight and embedded software applications. Versions prior to 4.2.0 have a vulnerability in the deserialization of file packets where an assertion can be triggered by an invalid file-packet type byte. This causes the application process to abort or reset, resulting in a denial of service. The issue is fixed in version 4.2.0.
CVE-2026-92150 is a reachable assertion vulnerability in the nasa fprime framework prior to version 4.2.0. The issue arises in the Svc::GenericHub fromBufferDriver_handler deserialization process, where externally influenced deserialization status and type validation use FW_ASSERT. This allows a command payload size subtraction to underflow. An unauthenticated inter-processor hub peer can send malformed hub traffic such as truncated buffers, invalid HubType, or header-only command-dispatch payloads, causing the process to abort or reset and resulting in denial of service. The vulnerability is fixed in version 4.2.0.
CVE-2026-92154 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.2.0. The vulnerability occurs in the Svc::FileUplink component's handleDataPacket function, where offset and size validation uses wrapping 32-bit unsigned arithmetic. This allows an attacker to supply a byteOffset and dataSize whose sum wraps around, causing data to be written beyond the declared upload size. This can lead to file integrity loss and potentially large sparse-file growth or resource exhaustion. The issue is fixed in version 4.2.0.
CVE-2026-92158 is an integer overflow vulnerability in the NASA fprime framework before version 4.2.0. It occurs in the Svc::FpySequencer STORE directive stack write validation, where an attacker-controlled offset and size are added before a memcpy operation. This can cause an integer wraparound, allowing memcpy to write outside the intended stack memory. The vulnerability can lead to memory corruption, denial of service, and potentially code execution. The issue is fixed in version 4.2.0.
CVE-2026-92159 is a medium severity vulnerability in NASA's F Prime (fprime) framework prior to version 4.3.0. The issue involves improper handling of length parameters in the Svc::TlmPacketizer component, where a fixed-slot copy operation copies more data than the allocated channel slot size, causing adjacent channel fields to be overwritten and resulting in corrupted telemetry packets. This flaw is fixed in version 4.3.0.
CVE-2026-92156 is a vulnerability in NASA's F Prime framework prior to version 4.3.0. It involves incorrect calculation of buffer size in the EventManager's log queue internal interface handler. The issue arises because EventManager accepts log buffers up to the maximum size but does not properly account for metadata overhead, leading to serialization failures and assertion triggers. This can cause a denial of service by aborting or resetting the process when a legal bridged event payload exceeds the remaining log-argument budget. The vulnerability is fixed in version 4.3.0.
CVE-2026-92157 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.3.0. The flaw occurs in the Svc::FileDownlink SendPartial range validation, where unchecked arithmetic on startOffset and length can cause a wraparound, leading to inconsistent offset values. This triggers an assertion failure under standard F Prime handling, causing the process to abort or reset and resulting in a denial of service. The issue is resolved in version 4.3.0.
CVE-2026-92152 is a critical vulnerability in NASA's F Prime (fprime) framework versions 4.1.0 up to but not including 4.2.0. It involves improper validation of an array index in the Svc::GenericHub output-port dispatch, where a deserialized port field is used without explicit range checks. This flaw can lead to out-of-bounds array access, resulting in heap corruption and potentially enabling remote code execution. The vulnerability is fixed in version 4.2.0.
CVE-2026-92153 is a path traversal vulnerability in NASA's F Prime (fprime) framework prior to version 4.3.0. The vulnerability arises from improper handling of file upload destination paths in the Svc::FileUplink component, which does not canonicalize or restrict paths. This allows an attacker able to send file-uplink packets to create or overwrite files at arbitrary writable filesystem locations, impacting integrity and potentially availability. The issue is fixed in version 4.3.0.
CVE-2026-92151 is a reachable assertion vulnerability in the nasa fprime framework prior to version 4.2.0. The issue occurs in the Svc::Ccsds::SpacePacketDeframer dataIn_handler, which treats a minimum packet-length condition as an assertion failure rather than gracefully rejecting the input. When a CCSDS telecommand frame payload is six bytes or fewer after header and trailer removal, the assertion triggers, aborting or resetting the flight software process and causing a denial of service. This vulnerability is fixed in version 4.2.0.
pbi-cli versions 3.10.1 through 3.12.0 have an OS command injection vulnerability in the desktop_sync.py component. The issue arises because unquoted .pbip file paths containing special characters like '&' are passed to the Windows command shell (cmd /c start) when reopening projects. This allows attackers to execute arbitrary commands with the victim's privileges if the victim opens a crafted Power BI project file. The vulnerability has a CVSS 4.0 score of 7.3, indicating high severity.
CVE-2026-105164 is an out-of-bounds read vulnerability in NASA cFS versions 7.0.0 and 7.0.1. The flaw exists in the function CFE_FS_ParseInputFileNameEx within the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This vulnerability can be remotely exploited and may lead to unauthorized memory access. A fix has been developed but is pending acceptance in a pull request. The issue has a medium severity rating with a CVSS score of 5.1.
CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic. With the shipped default configuration, command messages are forwarded through command_stream and emitted on the command-uplink UDP path. An attacker able to reach TCP port 5560 can subscribe to command and telemetry traffic on the ground bus. AIT-Core 3.1.2 changes the default ZeroMQ bind addresses to loopback.
NASA CryptoLib version 1.5.0 has an authentication downgrade vulnerability in its Telecommand receive path. The vulnerability arises because the receiver selects the Security Association (SA) based only on the SPI field in the incoming frame without verifying if the SA is authorized for the frame's GVCID. This flaw can allow unauthorized processing of frames, potentially compromising the security of telecommand communications.
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock() function in bpsec_util.c passes bundle->payload.length to zco_clone() without validating it against zero, causing a failed CHKZERO assertion that triggers sm_Abort() and terminates the process with SIGABRT before any HMAC verification occurs, requiring no valid key or credential to exploit.
ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger reads up to nine bytes past buffer boundaries and underflow byte counters.
CVE-2026-82802 is a server-side request forgery (SSRF) vulnerability in NASA earthdata-search version 1.0.0. The flaw exists in the OpenSearchGranuleSearchLambda function within the granules endpoint, allowing remote attackers to manipulate the openSearchOsdd argument to trigger SSRF. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). An exploit has been published, but there are no known active exploits in the wild. The vendor was contacted but did not respond. The product is a cloud service.
CVE-2026-82801 is a server-side request forgery (SSRF) vulnerability in NASA earthdata-search version 1.0.0. It affects the scaleImage function in the scale endpoint, allowing remote attackers to manipulate requests. The vulnerability has a medium severity score of 6.9 and public exploit code is available. The vendor has not responded or provided a patch.
CVE-2026-82480 is an integer underflow vulnerability in NASA cFS versions 7.0.0 and 7.0.1. The flaw exists in the function CFE_SB_GetUserDataLength within the cFE Software Bus component. Manipulating the TotalMsgSize/HdrSize argument can trigger the underflow. The vulnerability can be exploited remotely. No vendor response or patch information is currently available.