{"id":"CVE-2026-41144","summary":"F´ (F Prime) has Integer Overflow in FileUplink","details":"F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds check byteOffset + dataSize \u003e fileSize uses U32 addition that wraps around on overflow. An attacker-crafted DataPacket with byteOffset=0xFFFFFF9C and dataSize=100 overflows to 0, bypassing the check entirely. The subsequent file write proceeds at the original ~4GB offset. Additionally, Svc/FileUplink/File.cpp:20-31 performs no sanitization on the destination file path. Combined, these allow writing arbitrary data to any file at any offset. The impact is arbitrary file write leading to remote code execution on embedded targets. Note that this is a logic bug. ASAN does not detect it because all memory accesses are within valid buffers — the corruption occurs in file I/O. Version 4.2.0 contains a patch. No known workarounds are available.","aliases":["GHSA-qmvv-rxh4-ccqh"],"modified":"2026-08-12T16:24:11.526596Z","published":"2026-04-21T23:58:11.855Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-190","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41144.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41144.json"},{"type":"ADVISORY","url":"https://github.com/nasa/fprime/security/advisories/GHSA-qmvv-rxh4-ccqh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41144"},{"type":"FIX","url":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nasa/fprime","events":[{"introduced":"94b445715473b41484ea11a739f242478f02279e"},{"fixed":"cacdd555456bd83ab395b521d56c0330470ea798"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:nasa:fprime:4.1.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.1.1"},{"last_affected":"4.1.1"}]}}],"versions":["4.1.1","v4.2.0a1","v4.1.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41144.json","vanir_signatures_modified":"2026-08-12T16:24:11Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/FprimeDeframer/test/ut/FprimeDeframerTester.cpp","function":"FprimeDeframerTester::testIncorrectCrc"},"deprecated":false,"digest":{"function_hash":"34984416062446406807168176468061976434","length":294},"id":"CVE-2026-41144-070b7b86","signature_type":"Function"},{"target":{"file":"Svc/Ccsds/SpacePacketDeframer/SpacePacketDeframer.cpp","function":"SpacePacketDeframer::dataIn_handler"},"deprecated":false,"digest":{"function_hash":"269755958065402678790675314839305226148","length":1317},"id":"CVE-2026-41144-2185e38f","signature_type":"Function","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"},{"target":{"file":"Svc/Ccsds/SpacePacketDeframer/SpacePacketDeframer.cpp"},"deprecated":false,"digest":{"line_hashes":["224168381763804240084987365504908263876","259107961571916526036885092433648803792","152912594607239286107978083288802538259","55828676589751693272685804863298143857","106784549393805545431047589550381995079","204060672645406155155010540992402503446"],"threshold":0.9},"id":"CVE-2026-41144-237f5d44","signature_type":"Line","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"},{"deprecated":false,"digest":{"line_hashes":["162341472311402570695677176414943242543","328920561563054200928811596756891218526","257578491461341348915702526851869306154","306998362250195635367917760890941790131"],"threshold":0.9},"id":"CVE-2026-41144-30a517d0","signature_type":"Line","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/FileUplink/FileUplink.cpp"}},{"target":{"file":"Svc/FrameAccumulator/FrameDetector/FprimeFrameDetector.cpp"},"deprecated":false,"digest":{"line_hashes":["269821150380509338799472910591254919645","16019952879919634326646089409646482384","153830696007798369975857691332193451171","73283133126149622389774150060150532967","231566997984890195958587403806165077422","219112631728287329923301155752449500867","288760393143594939949192229324877934656"],"threshold":0.9},"id":"CVE-2026-41144-36fc48ec","signature_type":"Line","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"},{"deprecated":false,"digest":{"line_hashes":["298271733322618286160125707160325091455","180968850221775851313762441497932577655","336625717668340977113818458463196813447","267263355781687760717241625126779927022","81370616339315082846466046143576523800"],"threshold":0.9},"id":"CVE-2026-41144-3bf89a95","signature_type":"Line","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/Ccsds/TcDeframer/TcDeframer.cpp"}},{"id":"CVE-2026-41144-3c548dfb","signature_type":"Line","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Fw/Types/Serializable.hpp"},"deprecated":false,"digest":{"line_hashes":["67473461748051332198609020381243045288","94670347481015985362630984340010279780","60151953500423963115002045225362159358","250230925620352049778346631474242024094"],"threshold":0.9}},{"id":"CVE-2026-41144-486d6f8c","signature_type":"Function","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/FileUplink/FileUplink.cpp","function":"FileUplink::handleDataPacket"},"deprecated":false,"digest":{"function_hash":"226937703873442494584346177972966895410","length":886}},{"signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/Ccsds/TcDeframer/TcDeframer.cpp","function":"TcDeframer::dataIn_handler"},"deprecated":false,"digest":{"length":2407,"function_hash":"302598883018799417044391895534599914256"},"id":"CVE-2026-41144-4e9a956e","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/FileDownlink/FileDownlink.cpp","function":"FileDownlink::SendPartial_cmdHandler"},"deprecated":false,"digest":{"length":828,"function_hash":"105214089523772429594691074925750250824"},"id":"CVE-2026-41144-58bce98b","signature_type":"Function"},{"id":"CVE-2026-41144-5e478ed5","signature_type":"Function","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"function":"FileDownlink::SendFile_handler","file":"Svc/FileDownlink/FileDownlink.cpp"},"deprecated":false,"digest":{"length":849,"function_hash":"9948284884163289870960184450330750799"}},{"deprecated":false,"digest":{"function_hash":"66231399795421791488713451178493860355","length":802},"id":"CVE-2026-41144-6310a864","signature_type":"Function","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/FileDownlink/FileDownlink.cpp","function":"FileDownlink::SendFile_cmdHandler"}},{"digest":{"function_hash":"225578481640549711654890755485801473558","length":649},"id":"CVE-2026-41144-6bd77d06","signature_type":"Function","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Fw/FilePacket/FilePacket.cpp","function":"FilePacket::fromSerialBuffer"},"deprecated":false},{"id":"CVE-2026-41144-7dd1ef3b","signature_type":"Line","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/FprimeDeframer/FprimeDeframer.cpp"},"deprecated":false,"digest":{"line_hashes":["40134051091149071143734038382758222230","182400434357941692013719094866334375625","311315704173745551612272488068541295627","186018375819267643831945476077768679135"],"threshold":0.9}},{"source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Fw/FilePacket/FilePacket.cpp"},"deprecated":false,"digest":{"line_hashes":["272426436201470126938034535492887969429","108808370648495293568685404868373693605","22380975613168578806898861331386934022","108777147132680728146374363354452546944"],"threshold":0.9},"id":"CVE-2026-41144-93ccdcdb","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["242989710796051061159258288273749179658","247748742587555104699130293488471854489","287247909314152161970203510379818382646","241118622069639344544579678262930734918"],"threshold":0.9},"id":"CVE-2026-41144-9a58948b","signature_type":"Line","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/FprimeDeframer/test/ut/FprimeDeframerTester.cpp"}},{"target":{"file":"Svc/FprimeDeframer/FprimeDeframer.cpp","function":"FprimeDeframer::dataIn_handler"},"deprecated":false,"digest":{"function_hash":"138061229917945905381593366963754318754","length":2102},"id":"CVE-2026-41144-a1559b9d","signature_type":"Function","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/FrameAccumulator/FrameDetector/FprimeFrameDetector.cpp","function":"FprimeFrameDetector::detect"},"deprecated":false,"digest":{"function_hash":"48628339822164696443340822379922655433","length":2066},"id":"CVE-2026-41144-b2c2739b"},{"deprecated":false,"digest":{"line_hashes":["62608197360250518143238283632932497104","130785592689861715608857052897456190349","336840740631092923892587473842946591940","31821439248423992052041138083223685270","191039161274397319789162290569002308673","215898336390308012448939050816094644514","10527283212376802364038063673468829273","248870023288631632063225203815970100997","14623528165643927716935456428197459549","188349400070381159876378061276021895130","239912135271861765196035045898617007814","203312610517837004001762718488343517804","146832276613117942021261100425713615015","4139967856207257719113044835366808950","228396149323457815796872134881565266518","190924475529366866315387004983130106120","31821439248423992052041138083223685270","191039161274397319789162290569002308673","215898336390308012448939050816094644514","10527283212376802364038063673468829273","84670591901620310724018968579077093509","117681464282617511391300087257818366320","268049989308885375456030835102882755192","315957608794176782442382988904301235160","4139967856207257719113044835366808950","228396149323457815796872134881565266518","190924475529366866315387004983130106120","31821439248423992052041138083223685270","191039161274397319789162290569002308673","215898336390308012448939050816094644514","10527283212376802364038063673468829273","84670591901620310724018968579077093509","117681464282617511391300087257818366320","268049989308885375456030835102882755192","194400436011296016999738325832919333250"],"threshold":0.9},"id":"CVE-2026-41144-f4451d6d","signature_type":"Line","signature_version":"v1","source":"https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798","target":{"file":"Svc/FileDownlink/FileDownlink.cpp"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"}]}