CVE-2026-92159
- Source
- https://cve.org/CVERecord?id=CVE-2026-92159
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92159.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-92159
- Aliases
-
- GHSA-grrq-8rmr-xf83
- Published
- 2026-10-14T17:12:47Z
- Modified
- 2026-10-28T11:19:42Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry
- Details
-
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-130", "CWE-805" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92159.json" }- References
-
- https://github.com/nasa/fprime/releases/tag/v4.3.0a1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92159.json
- https://github.com/nasa/fprime/security/advisories/GHSA-grrq-8rmr-xf83
- https://nvd.nist.gov/vuln/detail/CVE-2026-92159
- https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96
- https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755
- https://github.com/nasa/fprime/pull/4878
Affected packages
Git / github.com/nasa/fprime
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nasa/fprime
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "4.3.0" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "048fe04062b91be7af138df7e09cdd15812dde96" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "7eacd551aaf6d9a21e347ac2c8d827ca15ee5755" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v4.3.0a1", "range": [ { "fixed": "a65ec3c4fd25cd53ac1a4a7b3ed60cb5676f6740" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
NASA-v1.*
NASA-v1.00
NASA-v1.3.1
NASA-v1.5.0
NASA-v1.5.1
NASA-v1.5.2
NASA-v1.5.3
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.6.0
v4.*
v4.0.0
v4.0.0a1
v4.0.0a2
v4.0.0a3
v4.0.1a1
v4.1.0
v4.1.1
v4.2.0a1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92159.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "232664947041192744648781709143534354674",
"length": 1024
},
"id": "CVE-2026-92159-02c3b072",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmPacketizer/TlmPacketizer.cpp",
"function": "TlmPacketizer::TlmRecv_handler"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287912458280500407758060243370594593775",
"length": 3387
},
"id": "CVE-2026-92159-09c155c3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96",
"target": {
"file": "Svc/TlmPacketizer/TlmPacketizer.cpp",
"function": "TlmPacketizer::setPacketList"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"337612994496679858314590795361783525235",
"62457136986504608755576733158615060208",
"12569394699695674909260420198797791498"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-10e3ab30",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/PrmDb/test/ut/PrmDbTestMain.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"222787131482120518251716835354659898102",
"51824597322933764863211015946371299732",
"53376529326087863142841747362345205969",
"171861938634991765839350611591010730261",
"325937448416385393060247786055576948258",
"2439072291430135741198188830357017750",
"285586420957443221731051371481579114974",
"62173026325033251811643089095469228959",
"216541303242993478751042845116078405035",
"77655783563582967627497894640792195321",
"192746948204438524787938761008243663658"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-42e4a379",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/PrmDb/PrmDbImpl.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "33694544387965999862140359696876832086",
"length": 597
},
"id": "CVE-2026-92159-493d165f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/GenericHub/GenericHub.cpp",
"function": "GenericHub::cmdDispIn_handler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"100704111566674463433849334460504922827",
"302474134253382566210654305714142523324",
"198778508135596777241495700393735405603",
"159906303523264340808492938161765963420"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-4e84dc6d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/GenericHub/test/ut/GenericHubTester.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"299123235707224754350746194143396309861",
"205280306785124182587517731348392015775",
"183017907960195363929555884650627022731",
"338961613657043806962616340388645226984",
"56393912019038515809961121284949585276",
"273316739487294293382825871270941841405",
"329766559139466791476339414735979366861",
"132262982234474237633737759585224049259"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-534743a4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmPacketizer/TlmPacketizer.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"87630093297689239754298806525774169194",
"104055020181761470814478681525934529074",
"238934902687552518073532826730530912244",
"227563611128078227038349906973352883974",
"253195833777889646623675623727364110891"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-56a62ad4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96",
"target": {
"file": "Svc/TlmPacketizer/TlmPacketizer.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "142354062731588905399513771210002085877",
"length": 233
},
"id": "CVE-2026-92159-5a432c01",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/GenericHub/test/ut/GenericHubTester.cpp",
"function": "GenericHubTester::test_command_dispatch"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "268911608865686961133737204821909387363",
"length": 967
},
"id": "CVE-2026-92159-5b176613",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "TestDeploymentsProject/Ref/SignalGen/SignalGen.cpp",
"function": "SignalGen::generateSample"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"135328073082190387233304947830046421416",
"140021370454449167442317130195346304842",
"188980701312819873449597783397851819167",
"203566989448311574913671412589886384629",
"300040357585624127937659169787884386523"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-5ba17867",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/EventManager/EventManager.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"194763558280177777981381205791129989796",
"228017385998078639478050330725197168174",
"42321853538104078078589652059635590110"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-615195bd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmChan/test/ut/TlmChanTester.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"297609755731138812466367585954741694067",
"9510581385373690021690389680481591484",
"88937972750511616509776235595042301303",
"116069785696062784985918507380042736002",
"283285381483931269696375669620754788445",
"60138785185997127175690055192148822668",
"101376610979891411888831770250609198567",
"283285632501811116862898745024592391523"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-6ca99a0e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "TestDeploymentsProject/Ref/SignalGen/SignalGen.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165036540855012828849688523819546009109",
"330124637778820581974728361087385268218",
"164333347606121420345473173008276972332",
"272215819423296319670359221304314183971"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-6d20fe40",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/GenericHub/GenericHub.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "9588817280311779881920725114870382588",
"length": 964
},
"id": "CVE-2026-92159-7e5c8684",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96",
"target": {
"file": "Svc/TlmPacketizer/TlmPacketizer.cpp",
"function": "TlmPacketizer::TlmRecv_handler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"313585113614504728576420913784486393282",
"108151476610115204854442963534793090797",
"111200364354784493924688561346983432960"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-7f913f5b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmPacketizer/test/ut/TlmPacketizerTester.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"88480029250957745557348714891123636178",
"163198698623040092995749277851372518697",
"705494807360900836890624002666557063"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-8021e094",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmPacketizer/test/ut/TlmPacketizerTester.hpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"271660723368200711655962190271818545500",
"139949812048004551492994350323065673159",
"13513158191883316267826859614050286327",
"146525373123029424612781089412883243671"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-8a1a9a69",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/PrmDb/test/ut/PrmDbTester.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "184053632970959904376208495743924710668",
"length": 1284
},
"id": "CVE-2026-92159-90a9fc88",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96",
"target": {
"file": "Svc/TlmPacketizer/TlmPacketizer.cpp",
"function": "TlmPacketizer::TlmGet_handler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"39079661264893137873426169774933235528",
"262078435828595060035384498532393130567",
"239971143979943148086422809186856800786"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-90dcc4cb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmChan/test/ut/TlmChanMain.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"89439852304101785725446436045284333335",
"133547289306404793003299637472117714689",
"291853764554719779250867891663455567730",
"4922391876589862819119780105334194756",
"242153491875288841021457002961220172032",
"112342647072889173016759010653100632908",
"246505414053129067367546554521992558683",
"187432299117822122272263156208915752905",
"36670224889306759312510109151091073280",
"233643294883580508540682092336398902395"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-963a2e0f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/PrmDb/PrmDbImpl.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "218749436304284526163171952890417907979",
"length": 676
},
"id": "CVE-2026-92159-9a885ad5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96",
"target": {
"file": "Svc/TlmPacketizer/TlmPacketizer.cpp",
"function": "m_configured"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"298417841181282358194322418810769325253",
"232079318329577732976665596923342812982",
"178960677672560448980483965669928190947",
"13147972684818607860913168177894030394",
"142239665428929129839146869146777296112",
"239864644476903166434792449016819119043",
"188268260607301783044385832036522052164",
"227367586525041889322633608806500244066",
"260588312567032757527975294369530998669",
"50039341948411880917095535907388085922",
"282788334528851297342440874609861125674",
"231504381464426838478435752702955147246",
"294838417771696123193843735928986898184",
"229313669427771117744081797320211206405",
"313366297147155417251893388654143633171",
"190622939004215198868291719145281373657",
"22173166270368105208590382860710289881",
"330703438815318073823202000874279988147",
"103047079527606034955802078652075535587",
"37888759890492638001132428728856657504",
"213027558972423597006550115132808239306",
"132457285282958990218648184717628840649",
"295803267284795085232778909391669375223",
"32289880168487933987030727259592691349",
"17855386722959636736803738965100666392",
"121393170368342323478026577698103557704",
"49360721718436068090708793108327436734",
"231504381464426838478435752702955147246",
"294838417771696123193843735928986898184",
"229313669427771117744081797320211206405",
"313366297147155417251893388654143633171",
"190622939004215198868291719145281373657",
"67493467249181653674706534738980912951",
"12742405129808492359522072920437200325",
"339074524030449436254542634823898702988",
"60333564127721347158999632602693123334",
"302373528644639503194693388078302542070",
"273134396588774627681329413292657277939",
"165021010783167333536167573197108878420",
"317173267291782092810044372117676966825",
"8067213190127095588759989216326922346",
"34582783289979856475552804814741655520",
"284376733709799778884339009251343021340",
"19162559573749853831852499113151589337",
"315795664980244427427822402648116265412",
"188645724471187388014911119138968494632",
"338326061606560467672050675816672975898",
"299123235707224754350746194143396309861",
"205280306785124182587517731348392015775",
"183017907960195363929555884650627022731",
"268015315023723322245515860907474282705",
"237823290262296128968895203948323587493",
"170577876723811722143468334171994229043",
"138884005871794129297602858961206854172",
"105263547908722060315059473166092619128",
"979465489545776017408874330040043349",
"88111197839661195890212643667882561748",
"34582783289979856475552804814741655520",
"20776670125260415880133083730259886242",
"143401237653420353992725036608791582276",
"171565811882428974552753393100772073104",
"88002129859632387667612242136338773936",
"261609673093733791292657514265810730002",
"300177838334057663015950429271686784876"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-a2173e5f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/048fe04062b91be7af138df7e09cdd15812dde96",
"target": {
"file": "Svc/TlmPacketizer/TlmPacketizer.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "63211147811325297434286819321116670078",
"length": 568
},
"id": "CVE-2026-92159-a84a0591",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/EventManager/EventManager.cpp",
"function": "EventManager::loqQueue_internalInterfaceHandler"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "218102533951847529784887295276060013889",
"length": 769
},
"id": "CVE-2026-92159-cf678384",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "TestDeploymentsProject/Ref/SignalGen/SignalGen.cpp",
"function": "SignalGen::Settings_cmdHandler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"336935121566104972826467663832693906578",
"277178622436036101240521324787602097516",
"2426390875097963836465022652912259997"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-d64f47f3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/PrmDb/test/ut/PrmDbTester.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"270246249999353383774302884723434058945",
"298236241454565674175817145329060288401",
"309318170785021705725485083913017112451"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-daf22508",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmPacketizer/test/ut/main.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "309256860880623038085023727259703656686",
"length": 5486
},
"id": "CVE-2026-92159-df174ea2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/PrmDb/PrmDbImpl.cpp",
"function": "PrmDbImpl::readParamFileImpl"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"132171535638196201418296410322928871862",
"268934982966219849038198346763902105747",
"146942900783842221937037528035087289089"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-e8a7fdd0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmChan/test/ut/TlmChanTester.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "239647359950006876696991363705149827462",
"length": 1704
},
"id": "CVE-2026-92159-ebb9d320",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmChan/TlmChan.cpp",
"function": "TlmChan::TlmRecv_handler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"32139410699422379807882651754329890995",
"185274965863823832570792227351777178613",
"321360768157156974004347244212796684810",
"25296765415918682286356181960868876196",
"105818599806394476013925086098429130780",
"130540107430402405646323311308854292191",
"47486051102582053245644356227566266676",
"190698959695617949211554034039279328092"
],
"threshold": 0.9
},
"id": "CVE-2026-92159-ed90c56e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755",
"target": {
"file": "Svc/TlmChan/TlmChan.cpp"
}
}
]
vanir_signatures_modified
"2026-10-28T11:19:42Z"