# CVE-2026-92150: F Prime GenericHub deserialization denial of service

Source: https://junglewise.ai/threats/cve-2026-92150-f-f-prime-is-a-framework-that-enables-development-and-deployment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-92150 · Severity: high · CVSS 7.5 · Published 2026-10-14

F Prime is a framework for developing spaceflight and embedded software applications. A flaw in the GenericHub component allows unauthenticated remote peers to send malformed inter-processor messages that crash the process, causing service disruption and potentially affecting mission-critical operations.

Technologies: [Nasa F Prime](https://junglewise.ai/threats/technologies/f-prime). Vendors: [Nasa](https://junglewise.ai/threats/vendors/nasa).

## Quick answers

**Is CVE-2026-92150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92150 being exploited in the wild.

**How severe is CVE-2026-92150?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** Nasa F Prime prior to 4.2.0.

**Is there a fix for CVE-2026-92150?** Yes: fixed in 4.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92150 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92150?** Check whether you run Nasa F Prime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.2.0

## Technical details

The GenericHub fromBufferDriver_handler uses hard assertions (FW_ASSERT) to validate externally supplied deserialization status and type information, and permits integer underflow in command payload size calculations. An unauthenticated inter-processor hub peer can send truncated buffers, invalid HubType values, or header-only command payloads to trigger a process abort or reset, resulting in denial of service.

## Affected products

- NASA F Prime prior to 4.2.0

## Timeline

- 2026-10-14: disclosed
- 2026-04-01: patched: Fix commit merged

## References

- [https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986](https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986)
- [https://github.com/nasa/fprime/pull/4929](https://github.com/nasa/fprime/pull/4929)

## Related threats

- [NASA F Prime FileDownlink integer overflow bypass](https://junglewise.ai/threats/cve-2026-92160-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime TlmPacketizer buffer overflow in telemetry handler](https://junglewise.ai/threats/cve-2026-92159-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime integer wraparound in FpySequencer STORE bounds check](https://junglewise.ai/threats/cve-2026-92158-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime FileDownlink SendPartial integer overflow denial of service](https://junglewise.ai/threats/cve-2026-92157-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime EventManager denial of service via oversized log packet](https://junglewise.ai/threats/cve-2026-92156-f-f-prime-is-a-framework-that-enables-development-and-deployment)