# CVE-2026-92152: F´ (F Prime) GenericHub array out-of-bounds in deserialization

Source: https://junglewise.ai/threats/cve-2026-92152-f-f-prime-is-a-framework-that-enables-development-and-deployment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-92152 · Severity: info · Published 2026-10-14

F´ is a framework for developing spaceflight and embedded software systems. In versions 4.1.0 through 4.2.0, a remote attacker can send specially crafted hub packets that trigger out-of-bounds array access in the GenericHub component. On systems with assertions enabled, this causes a crash (denial of service); on systems without assertions, it corrupts heap memory and may enable remote code execution.

Vendors: [Nasa](https://junglewise.ai/threats/vendors/nasa).

## Quick answers

**Is CVE-2026-92152 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92152 being exploited in the wild.

**How severe is CVE-2026-92152?** Informational severity, published 14 October 2026.

**Which products and versions are affected?** Nasa F´ (F Prime) 4.1.0 until 4.2.0.

**Is there a fix for CVE-2026-92152?** Yes: fixed in 4.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92152 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92152?** Check whether you run Nasa F´ (F Prime) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.2.0

## Technical details

A missing range check in Svc::GenericHub's deserialization routine allows a remote packet to specify an arbitrary port index. This index is passed directly to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without validation. An out-of-bounds array access results; assertion-enabled builds abort with an assertion failure, while non-assertion builds corrupt heap memory with potential remote code execution. The vulnerability affects versions 4.1.0 to 4.2.0 and is fixed in 4.2.0.

## Affected products

- NASA F´ (F Prime) 4.1.0 until 4.2.0

## Timeline

- 2026-10-14: disclosed
- 2026-04-01: patched: Fix commit merged

## References

- [https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986](https://github.com/nasa/fprime/commit/b56b53634fd4251ae84919f22dcff829ef9e0986)
- [https://github.com/nasa/fprime/pull/4929](https://github.com/nasa/fprime/pull/4929)