External risk intelligence

F Prime GenericHub Output Port Out-of-Bounds Access

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-92152

F Prime (F') is a specialized software framework designed for developing and deploying spaceflight and embedded applications. These systems are typically deployed in isolated, proprietary, or highly controlled environments—such as spacecraft or specialized hardware—rather than on public-facing internet infrastructure.

Remote Code Execution

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the F Prime framework, which is used for spaceflight and embedded software applications. This flaw could allow for out-of-bounds memory access, heap corruption, and potentially remote code execution if exploited. The main concern is to confirm if our environment utilizes the affected technology.

Unchecked data could corrupt memory and allow code execution.
Understand if this specialized framework is in use.
Confirm relevance and exposure of this specialized software.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted packets to a vulnerable F´ deployment. This could lead to a crash or potentially remote code execution if the F´ system is not configured to perform explicit range checks on incoming data, allowing the attacker to manipulate memory.

Unauthenticated network access required.
Specially crafted packets trigger the vulnerability.
Heap corruption, potential code execution.

Live Threat

Current exploitation, exposure, and threat context

When assert-enabled builds of F Prime are not used, remote attackers could exploit this vulnerability by sending a specially crafted hub packet. This could lead to heap memory corruption and potentially allow for remote code execution.

Corrupts heap memory and could enable remote code execution.
Via crafted remote hub packets to an out-of-bounds array.
Compromises system integrity and execution control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability exists in the F´ framework's generic hub component, impacting systems developed for spaceflight and embedded applications. Ownership likely resides with the application development teams who implement F´, along with platform or infrastructure teams managing the deployment environment. The immediate first step is to identify all F´ deployments, confirm their criticality and exposure, and then coordinate with accountable owners to plan remediation, prioritizing systems where assertions are not enabled.

Application development and platform teams own this.
Verify if assertion-enabled builds are used.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the F Prime framework?

F Prime (F') is an open-source software framework created by NASA for building spaceflight and embedded applications. It provides modular components to handle communications, data handling, and system logic. Because it is designed for high-reliability environments like spacecraft, satellites, and specialized scientific hardware, it is typically deployed in isolated or highly controlled settings rather than standard web servers.

What does CWE-129 mean for CVE-2026-92152?

CWE-129 refers to an Improper Validation of Array Index. In this CVE, the GenericHub component fails to verify that an incoming port index is within the expected range before using it to access an array. Because the software does not check if the requested index is valid, a malformed input can cause the system to read or write memory outside of the intended buffer, a weakness that leads to heap corruption.

How is this vulnerability triggered?

The vulnerability is triggered when a remote hub packet contains a port index that exceeds the size of the configured output-port array. It is important to note that the vulnerability does not occur if the system uses assert-enabled builds, as these will simply abort execution rather than allowing the out-of-bounds memory access to proceed. Execution only continues into the dangerous state in builds where such checks are absent.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely for most organizations. Because F Prime is built for specialized, often isolated spaceflight or embedded hardware, it is rarely found on public-facing internet infrastructure. Systems that are not connected to external networks or that operate in highly controlled, proprietary environments are naturally shielded from the remote network access required to send the malicious packets.

What should I do if I use F Prime?

First, inventory your software stack to determine if any applications use the GenericHub component within F Prime versions 4.1.0 through 4.1.x. Identify whether these deployments use assertion-enabled builds, as these provide a built-in safeguard. Coordinate with the development teams responsible for your F Prime implementations to upgrade to version 4.2.0, which includes the necessary range checks to prevent this issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.