# CVE-2026-92156: F Prime EventManager denial of service via oversized log packet

Source: https://junglewise.ai/threats/cve-2026-92156-f-f-prime-is-a-framework-that-enables-development-and-deployment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-92156 · Severity: medium · CVSS 6.5 · Published 2026-10-14

F Prime is a framework used to develop and deploy software for spacecraft and embedded systems. Prior to version 4.3.0, the EventManager component can be triggered to crash or reset when it receives an oversized log event from a connected GenericHub, causing service disruption to critical flight or embedded operations.

Technologies: [Nasa F Prime](https://junglewise.ai/threats/technologies/f-prime). Vendors: [Nasa](https://junglewise.ai/threats/vendors/nasa).

## Quick answers

**Is CVE-2026-92156 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92156 being exploited in the wild.

**How severe is CVE-2026-92156?** Medium severity, with a CVSS score of 6.5, published 14 October 2026.

**Which products and versions are affected?** Nasa F Prime prior to 4.3.0.

**Is there a fix for CVE-2026-92156?** Yes: fixed in 4.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92156 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92156?** Check whether you run Nasa F Prime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.3.0

## Technical details

The EventManager accepts log packets up to the framework's maximum log buffer size, but the packet's metadata (descriptor, event ID, and time-tag) consume part of the available ComBuffer space, leaving less room for the actual log arguments. If a bridged event payload larger than the remaining budget is received from GenericHub, serialization fails and hits an FW_ASSERT, resulting in denial of service. The fix (version 4.3.0) validates packet size and drops oversized events rather than asserting.

## Affected products

- NASA F Prime prior to 4.3.0

## Timeline

- 2026-10-14: disclosed
- 2026-08-11: patched: commit 7eacd551aaf6d9a21e347ac2c8d827ca15ee5755; PR #5633 merged

## References

- [https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755](https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755)
- [https://github.com/nasa/fprime/pull/5633](https://github.com/nasa/fprime/pull/5633)

## Related threats

- [NASA F Prime FileDownlink integer overflow bypass](https://junglewise.ai/threats/cve-2026-92160-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime TlmPacketizer buffer overflow in telemetry handler](https://junglewise.ai/threats/cve-2026-92159-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime integer wraparound in FpySequencer STORE bounds check](https://junglewise.ai/threats/cve-2026-92158-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime FileDownlink SendPartial integer overflow denial of service](https://junglewise.ai/threats/cve-2026-92157-f-f-prime-is-a-framework-that-enables-development-and-deployment)
- [F Prime FilePacket deserialization denial of service](https://junglewise.ai/threats/cve-2026-92155-f-f-prime-is-a-framework-that-enables-development-and-deployment)