CVE-2026-41144

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41144", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-17T12:59:15.739Z", "datePublished": "2026-04-21T23:58:11.855Z", "dateUpdated": "2026-04-22T18:15:17.297Z"}, "containers": {"cna": {"title": "F\u00b4 (F Prime) has Integer Overflow in FileUplink", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nasa/fprime/security/advisories/GHSA-qmvv-rxh4-ccqh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nasa/fprime/security/advisories/GHSA-qmvv-rxh4-ccqh"}, {"name": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798", "tags": ["x_refsource_MISC"], "url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"}], "affected": [{"vendor": "nasa", "product": "fprime", "versions": [{"version": "< 4.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T23:58:11.855Z"}, "descriptions": [{"lang": "en", "value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds check byteOffset + dataSize > fileSize uses U32 addition that wraps around on overflow. An attacker-crafted DataPacket with byteOffset=0xFFFFFF9C and dataSize=100 overflows to 0, bypassing the check entirely. The subsequent file write proceeds at the original ~4GB offset. Additionally, Svc/FileUplink/File.cpp:20-31 performs no sanitization on the destination file path. Combined, these allow writing arbitrary data to any file at any offset. The impact is arbitrary file write leading to remote code execution on embedded targets. Note that this is a logic bug. ASAN does not detect it because all memory accesses are within valid buffers \u2014 the corruption occurs in file I/O. Version 4.2.0 contains a patch. No known workarounds are available."}], "source": {"advisory": "GHSA-qmvv-rxh4-ccqh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T18:14:58.787369Z", "id": "CVE-2026-41144", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:15:17.297Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T18:14:58.787369Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:15:05.159Z"}}], "cna": {"title": "F\u00b4 (F Prime) has Integer Overflow in FileUplink", "source": {"advisory": "GHSA-qmvv-rxh4-ccqh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 0, "attackVector": "NETWORK", "baseSeverity": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nasa", "product": "fprime", "versions": [{"status": "affected", "version": "< 4.2.0"}]}], "references": [{"url": "https://github.com/nasa/fprime/security/advisories/GHSA-qmvv-rxh4-ccqh", "name": "https://github.com/nasa/fprime/security/advisories/GHSA-qmvv-rxh4-ccqh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798", "name": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds check byteOffset + dataSize > fileSize uses U32 addition that wraps around on overflow. An attacker-crafted DataPacket with byteOffset=0xFFFFFF9C and dataSize=100 overflows to 0, bypassing the check entirely. The subsequent file write proceeds at the original ~4GB offset. Additionally, Svc/FileUplink/File.cpp:20-31 performs no sanitization on the destination file path. Combined, these allow writing arbitrary data to any file at any offset. The impact is arbitrary file write leading to remote code execution on embedded targets. Note that this is a logic bug. ASAN does not detect it because all memory accesses are within valid buffers \u2014 the corruption occurs in file I/O. Version 4.2.0 contains a patch. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T23:58:11.855Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41144", "state": "PUBLISHED", "dateUpdated": "2026-04-22T18:15:17.297Z", "dateReserved": "2026-04-17T12:59:15.739Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T23:58:11.855Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fprime", "vendor": "nasa", "versions": [{"status": "affected", "version": "< 4.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nasa:fprime:4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "32D82320-65FE-412C-9588-FE47713A2D46", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "F\u00b4 (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds check byteOffset + dataSize > fileSize uses U32 addition that wraps around on overflow. An attacker-crafted DataPacket with byteOffset=0xFFFFFF9C and dataSize=100 overflows to 0, bypassing the check entirely. The subsequent file write proceeds at the original ~4GB offset. Additionally, Svc/FileUplink/File.cpp:20-31 performs no sanitization on the destination file path. Combined, these allow writing arbitrary data to any file at any offset. The impact is arbitrary file write leading to remote code execution on embedded targets. Note that this is a logic bug. ASAN does not detect it because all memory accesses are within valid buffers \u2014 the corruption occurs in file I/O. Version 4.2.0 contains a patch. No known workarounds are available."}, {"lang": "es", "value": "F\u2019 (F Prime) es un framework que permite el desarrollo y la implementaci\u00f3n de aplicaciones de software para vuelos espaciales y otras aplicaciones embebidas. Antes de la versi\u00f3n 4.2.0, la comprobaci\u00f3n de l\u00edmites byteOffset + dataSize > fileSize utiliza una suma U32 que se ajusta en caso de desbordamiento. Un DataPacket creado por un atacante con byteOffset=0xFFFFFF9C y dataSize=100 se desborda a 0, eludiendo completamente la comprobaci\u00f3n. La escritura de archivo subsiguiente procede en el desplazamiento original de ~4GB. Adem\u00e1s, Svc/FileUplink/File.cpp:20-31 no realiza ninguna sanitizaci\u00f3n en la ruta del archivo de destino. Combinado, esto permite escribir datos arbitrarios en cualquier archivo en cualquier desplazamiento. El impacto es una escritura de archivo arbitraria que conduce a la ejecuci\u00f3n remota de c\u00f3digo en objetivos embebidos. Tenga en cuenta que esto es un error de l\u00f3gica. ASAN no lo detecta porque todos los accesos a memoria est\u00e1n dentro de b\u00faferes v\u00e1lidos - la corrupci\u00f3n ocurre en la E/S de archivos. La versi\u00f3n 4.2.0 contiene un parche. No se conocen soluciones alternativas disponibles."}], "id": "CVE-2026-41144", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0.0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 0.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41144", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T18:14:58.787369Z", "version": "2.0.3"}}]}, "published": "2026-04-22T00:16:29.550", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/nasa/fprime/security/advisories/GHSA-qmvv-rxh4-ccqh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fprime", "source": "cna", "vendor": "nasa"}, "product": "fprime", "vendor": "nasa"}], "analysis": {"en": {"generated_at": "2026-04-22T04:24:20.542655+00:00", "value": {"mitigation_remediation": ["Update F Prime to version\u202f4.2.0 or later, which contains the integer\u2011overflow and path\u2011sanitation fix.", "If an update cannot be applied immediately, disable or restrict the FileUplink service to only trusted sources.", "Add explicit validation of payload lengths and destination paths before performing file writes in any custom or legacy implementation."], "summary": {"action": "Patch the framework", "impact": "Arbitrary file write leading to remote code execution"}, "threat_synthesis": {"affected_systems": "Affected systems are deployments of NASA\u2019s F Prime framework older than version\u202f4.2.0. The vulnerability is present in the natural file uplink used by many spaceflight and other embedded software applications that rely on F Prime for data transfer.", "description_and_impact": "A logic flaw in the F Prime FileUplink component causes an unsigned integer overflow when calculating the boundary byteOffset + dataSize against the fileSize. An attacker can send a crafted packet with a large byteOffset that wraps to zero, bypassing the bounds check and writing data starting at an offset close to the full 4GB range. In addition, the code that writes to the destination file performs no validation of the file path, enabling a write to any arbitrary file. The combination of these defects permits an attacker to inject arbitrary data into any file on the target system, which can then be used to achieve remote code execution on the embedded device.\n\nAffected systems are deployments of NASA\u2019s F Prime framework older than version 4.2.0. The vulnerability is present in the natural file uplink used by many spaceflight and other embedded software applications that rely on F Prime for data transfer.\n\nRisk and exploitability: The flaw has no public exploit probability score available and is not listed in the CISA KEV catalog, but its potential impact is severe. The vulnerability requires the ability to send a specially crafted data packet and access to the FileUplink service, which may be exposed locally or remotely depending on the deployment. Because the corruption occurs at the file I/O layer, typical memory corruption detection tools do not catch it. Attackers who succeed can overwrite critical binaries or configuration files, resulting in complete compromise of an embedded target.", "risk_and_exploitability": "Risk and exploitability: The flaw has no public exploit probability score available and is not listed in the CISA KEV catalog, but its potential impact is severe. The vulnerability requires the ability to send a specially crafted data packet and access to the FileUplink service, which may be exposed locally or remotely depending on the deployment. Because the corruption occurs at the file I/O layer, typical memory corruption detection tools do not catch it. Attackers who succeed can overwrite critical binaries or configuration files, resulting in complete compromise of an embedded target."}}}}, "created": "2026-04-22T02:00:04.888329+00:00", "updated": "2026-04-22T04:30:05.302273+00:00", "vendors": ["nasa", "nasa$PRODUCT$fprime"]}