# CVE-2026-92155: F Prime FilePacket deserialization denial of service

Source: https://junglewise.ai/threats/cve-2026-92155-f-f-prime-is-a-framework-that-enables-development-and-deployment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-92155 · Severity: high · CVSS 7.5 · Published 2026-10-14

F´ (F Prime) is a framework used for spaceflight and embedded software applications. A flaw in how it processes file upload packets allows an attacker on the network to send a specially crafted packet that triggers an assertion failure, crashing or resetting the application and causing a denial of service.

Technologies: [Nasa F Prime](https://junglewise.ai/threats/technologies/f-prime). Vendors: [Nasa](https://junglewise.ai/threats/vendors/nasa).

## Quick answers

**Is CVE-2026-92155 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92155 being exploited in the wild.

**How severe is CVE-2026-92155?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** Nasa F Prime prior to 4.2.0.

**Is there a fix for CVE-2026-92155?** Yes: fixed in 4.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92155 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92155?** Check whether you run Nasa F Prime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.2.0

## Technical details

The vulnerability exists in Fw::FilePacket deserialization used by Svc::FileUplink, where the type byte in the file packet header is cast to an enum without range validation. When an invalid type byte is received, the code reaches a FW_ASSERT that aborts the process rather than gracefully handling the error. An attacker with network access can send a file packet with an unknown type byte to trigger the denial of service.

## Affected products

- NASA F Prime prior to 4.2.0

## Timeline

- 2026-10-14: disclosed
- 2026-03-31: patched: Fix merged in pull request #4919

## References

- [https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798](https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798)
- [https://github.com/nasa/fprime/pull/4919](https://github.com/nasa/fprime/pull/4919)

## Related threats

- [NASA F Prime FileDownlink integer overflow bypass](https://junglewise.ai/threats/cve-2026-92160-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime TlmPacketizer buffer overflow in telemetry handler](https://junglewise.ai/threats/cve-2026-92159-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime integer wraparound in FpySequencer STORE bounds check](https://junglewise.ai/threats/cve-2026-92158-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime FileDownlink SendPartial integer overflow denial of service](https://junglewise.ai/threats/cve-2026-92157-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime EventManager denial of service via oversized log packet](https://junglewise.ai/threats/cve-2026-92156-f-f-prime-is-a-framework-that-enables-development-and-deployment)