NASA F Prime: File size bounds bypass in FileUplink via integer overflow
Summary
F Prime, a framework for spaceflight and other embedded software, is affected in the Svc::FileUplink component. Attacker-controlled byteOffset and dataSize values in a file-uplink DATA packet can wrap around in 32-bit arithmetic, so the bounds check passes and data is written beyond the declared upload size. An attacker who can send uplink packets can corrupt uploaded files and cause disk or resource exhaustion; the CVSS vector requires low privileges.
Affected
- F Prime (nasa/fprime) versions prior to 4.2.0
- Component: Svc::FileUplink
Fixed in
- Upgrade to F Prime 4.2.0 or later (fix commit cacdd555456bd83ab395b521d56c0330470ea798, PR #4919)
- Unknown whether 4.2.0 is the newest release that includes all relevant fixes; verify against the current release notes.
Workaround
- Unknown.
- Until the upgrade is done, restrict which peers can reach the file uplink channel.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'.
- No known exploitation in the wild; not listed in KEV.
- Public exploit code: none found.
Our recommendation
- Check whether F Prime is used in your environment; if not, no action needed.
- If used, upgrade to 4.2.0 or the newest F Prime release.
- Limit access to the file uplink channel to trusted peers and monitor FileUplink events for unexpected offsets or file sizes.
- Verify the integrity of files received through the uplink.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wx8q-q5gx-f54p github.com
- Fix commit cacdd55 github.com
- Pull Request #4919 github.com
- F Prime releases github.com
- F Prime FileUplink component documentation nasa.github.io
- CVE record summary (OpenCVE) app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:04.
Original description (NVD)
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.