CVE-2026-41144

{
  "id": "CVE-2026-41144",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-22T00:16:29.550",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds check byteOffset + dataSize > fileSize uses U32 addition that wraps around on overflow. An attacker-crafted DataPacket with byteOffset=0xFFFFFF9C and dataSize=100 overflows to 0, bypassing the check entirely. The subsequent file write proceeds at the original ~4GB offset. Additionally, Svc/FileUplink/File.cpp:20-31 performs no sanitization on the destination file path. Combined, these allow writing arbitrary data to any file at any offset. The impact is arbitrary file write leading to remote code execution on embedded targets. Note that this is a logic bug. ASAN does not detect it because all memory accesses are within valid buffers — the corruption occurs in file I/O. Version 4.2.0 contains a patch. No known workarounds are available."
    },
    {
      "lang": "es",
      "value": "F’ (F Prime) es un framework que permite el desarrollo y la implementación de aplicaciones de software para vuelos espaciales y otras aplicaciones embebidas. Antes de la versión 4.2.0, la comprobación de límites byteOffset + dataSize > fileSize utiliza una suma U32 que se ajusta en caso de desbordamiento. Un DataPacket creado por un atacante con byteOffset=0xFFFFFF9C y dataSize=100 se desborda a 0, eludiendo completamente la comprobación. La escritura de archivo subsiguiente procede en el desplazamiento original de ~4GB. Además, Svc/FileUplink/File.cpp:20-31 no realiza ninguna sanitización en la ruta del archivo de destino. Combinado, esto permite escribir datos arbitrarios en cualquier archivo en cualquier desplazamiento. El impacto es una escritura de archivo arbitraria que conduce a la ejecución remota de código en objetivos embebidos. Tenga en cuenta que esto es un error de lógica. ASAN no lo detecta porque todos los accesos a memoria están dentro de búferes válidos - la corrupción ocurre en la E/S de archivos. La versión 4.2.0 contiene un parche. No se conocen soluciones alternativas disponibles."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nasa",
          "product": "fprime",
          "versions": [
            {
              "version": "< 4.2.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
          "baseScore": 0.0,
          "baseSeverity": "NONE",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 0.0
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T18:14:58.787369Z",
          "id": "CVE-2026-41144",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nasa:fprime:4.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "32D82320-65FE-412C-9588-FE47713A2D46"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/nasa/fprime/security/advisories/GHSA-qmvv-rxh4-ccqh",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}