Is CVE-2026-92160 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92160 being exploited in the wild.

How severe is CVE-2026-92160?

Medium severity, with a CVSS score of 6.5, published 14 October 2026.

Is there a fix for CVE-2026-92160?

Yes: fixed in 4.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92160 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92160?

Check whether you run Nasa F Prime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92160: NASA F Prime FileDownlink integer overflow bypass

CVE-2026-92160 · Severity: medium · CVSS 6.5 · Published 2026-10-14

F Prime is a framework used to develop and deploy embedded software for spacecraft and other critical systems. A vulnerability in the FileDownlink component allows an attacker with the ability to send commands to trigger a denial-of-service condition by causing the spacecraft software to crash or reset during file download operations, potentially disrupting mission-critical functionality.

Technologies: Nasa F Prime. Vendors: Nasa.

Quick answers

Is CVE-2026-92160 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92160 being exploited in the wild.
How severe is CVE-2026-92160?: Medium severity, with a CVSS score of 6.5, published 14 October 2026.
Which products and versions are affected?: Nasa F Prime prior to 4.3.0.
Is there a fix for CVE-2026-92160?: Yes: fixed in 4.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92160 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92160?: Check whether you run Nasa F Prime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.3.0

Technical details

A U32 integer overflow in the Svc::FileDownlink SendPartial method bypasses file-range validation when a caller supplies a length parameter that wraps when added to the startOffset. This causes m_byteOffset to exceed m_endOffset, leading to an out-of-bounds read attempt that triggers an FW_ASSERT and aborts the process. The vulnerability requires an attacker capable of invoking the SendPartial command with a source file larger than the supplied startOffset.

Affected products

NASA F Prime prior to 4.3.0

Timeline

2026-10-14: disclosed
2026-08-12: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.