CVE-2026-92158

Executive Summary

CVE-2026-92158 is an integer wraparound vulnerability in the Svc::FpySequencer component of F´ (F Prime), a framework used for spaceflight and embedded software applications. Prior to version 4.2.0, a stack write validation bounds check adds an attacker-controlled offset and size before calling memcpy, allowing an integer overflow that makes an out-of-range destination appear valid, leading to memory corruption. Affected systems include any deployment using F´ versions earlier than 4.2.0 with the FpySequencer service enabled and reachable by a user capable of supplying sequence directives, resulting in potential denial of service or code execution.

Technical Analysis

The vulnerability resides in the Svc::FpySequencer component's handling of STORE directives that write to the sequencer stack. The core issue is a classic integer wraparound (CWE-190) in the bounds check that validates stack writes. Before performing a memcpy, the code validates a destination range by summing an attacker-controlled offset and size. When these two U32 values are added, the arithmetic can wrap around modulo 2^32, producing a small sum that passes the bounds validation. The subsequent memcpy then uses the original unwrapped offset and size, resulting in a write beyond the allocated stack buffer. The NVD description states: "the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid." This means the check logic is flawed because it performs addition before comparison rather than performing separate range checks that account for overflow. The attack surface is the sequence directive processing path within FpySequencer. An actor who can supply or control sequence directives—specifically a STORE directive with a crafted stack offset and size whose U32 sum wraps—can trigger the condition. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and high confidentiality, integrity, and availability impact. The high privilege requirement reflects the need to supply or manipulate sequence directives, which typically requires authenticated access or control over the sequence execution pipeline. The vulnerability class is memory corruption via integer overflow, with impacts including out-of-bounds write, denial of service, and potentially arbitrary code execution depending on the memory layout and the ability to influence adjacent data. No public proof-of-concept or exploit code is available, and no Nuclei template exists. The patch confidence is 0/4, indicating that no patch evidence has been tracked from any source, though the NVD description notes the issue is fixed in version 4.2.0.

Exploitation Scenarios

Based strictly on the NVD description, the attack chain for CVE-2026-92158 is as follows. First, reconnaissance and target identification: an attacker must identify an F´ deployment running a version prior to 4.2.0 that includes the FpySequencer service. This could be a spaceflight or embedded system, a ground station, or a development/test environment. The attacker must determine that they can influence or supply sequence directives processed by FpySequencer, which typically requires some level of privileged access or control over the command and data handling path. Second, triggering the flaw class: the attacker crafts a sequence containing a STORE directive that specifies a stack offset and size such that their U32 sum wraps around. For example, an offset near the maximum U32 value combined with a size that pushes the sum past 2^32 will wrap to a small number, passing the flawed bounds check. The memcpy then writes to an out-of-range destination computed from the original offset. Third, payload and execution method at the vulnerability-class level: the out-of-bounds write corrupts memory outside the sequencer stack. Depending on the contents of the write and the memory layout, this can crash the system (denial of service) or overwrite control data to achieve code execution. The NVD description explicitly notes "memory corruption, denial of service, and potentially code execution." No public PoC is available; the attack chain is inferred from the vulnerability class and the description. Specific function names, parameter names, or memory addresses beyond those mentioned (Svc::FpySequencer, STORE, memcpy) are not provided and should not be fabricated. Fourth, post-exploitation impact: successful exploitation could allow an attacker to disrupt mission operations, cause loss of control over the embedded system, or execute arbitrary code within the context of the F´ application, potentially compromising the entire spacecraft or embedded platform.

Impact Assessment

The business impact of CVE-2026-92158 is significant for organizations using F´ in spaceflight or other embedded systems. The CVSS v3.1 base score is 7.2 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. This indicates network exploitable, low attack complexity, high privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. The scope is unchanged, meaning the vulnerable component and the affected system are the same security authority. Affected systems include any deployment running F´ versions prior to 4.2.0 with FpySequencer enabled. The blast radius could extend to the entire mission or platform, as memory corruption in a critical sequencer component can lead to loss of control, system crashes, or arbitrary code execution. The high privileges required (PR:H) somewhat limits the attacker pool to those who can supply sequence directives, but in many embedded systems, the sequence interface may be accessible to operators, ground station software, or other connected components. The absence of a public PoC and the unpatched status (patch confidence 0/4) increase the risk because defenders may not have immediate signatures or mitigations, though version 4.2.0 is noted as the fix. The EPSS score is not yet available, and CISA KEV does not list this CVE, so there is no confirmed exploit-in-the-wild evidence at this time.

Detection Guidance

Sigma Rule

title: F´ FpySequencer STORE Directive Integer Overflow Attempt
id: 7a3b9c1e-5f2d-4a8b-9c3e-1d2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2026-92158 via sequence directives with STORE offsets and sizes that sum to a wrapped U32 value.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
    category: application
    product: fprime
    service: fpysequencer
detection:
    selection:
        directive: 'STORE'
    filter_valid:
        offset: 
            - '< 4294967295'
        size:
            - '< 4294967295'
    condition: selection and not filter_valid
fields:
    - offset
    - size
    - directive
falsepositives:
    - Legitimate sequences with large offsets and sizes that do not wrap
level: high
tags:
    - attack.t1190
    - cve.2026.92158

YARA Rule

rule CVE_2026_92158_FPrime_FpySequencer_Integer_Overflow
{
    meta:
        description = "Detects sequence files or memory patterns attempting to exploit CVE-2026-92158 in F´ FpySequencer"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92158"
        severity = "high"
    strings:
        $store_directive = "STORE" ascii wide nocase
        $fpy_sequencer = "FpySequencer" ascii wide nocase
        $svc_fpy = "Svc::FpySequencer" ascii wide nocase
        $stack_keyword = "stack" ascii wide nocase
    condition:
        any of ($store_directive*) and any of ($fpy_sequencer*, $svc_fpy*) and $stack_keyword
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-92158 F´ FpySequencer STORE Directive Integer Overflow Attempt"; flow:established,to_server; content:"STORE"; nocase; content:"FpySequencer"; nocase; distance:0; within:100; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-admin; reference:cve,2026-92158; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92158; sid:202692158; rev:1;)

Elastic Detection

sequence by host.id, process.entity_id with maxspan=5s
  [process where process.name != null and process.args : "*STORE*" and process.args : "*FpySequencer*"]
  [process where process.name != null and process.args : "*memcpy*" and process.args : "*stack*"]

Splunk SPL Query

index=fprime_logs sourcetype=fprime:sequencer
| search "STORE" AND ("FpySequencer" OR "Svc::FpySequencer" OR "memcpy")
| eval offset=coalesce(offset, 0), size=coalesce(size, 0)
| where (offset + size) >= 4294967296 OR (offset > 0 AND size > 0 AND offset + size < offset)
| table _time, host, process, directive, offset, size, message
| sort - _time

Wazuh OSSEC Rule

<group name="fprime,cve-2026-92158,">
  <rule id="100921" level="12">
    <decoded_as>json</decoded_as>
    <field name="directive">STORE</field>
    <field name="offset">\.+</field>
    <field name="size">\.+</field>
    <description>CVE-2026-92158: Potential F´ FpySequencer STORE directive integer overflow attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict access to the FpySequencer interface to only fully trusted operators or systems. Enforce strong authentication and authorization for any component that can supply sequence directives.
   • Monitor and log all sequence directives, particularly STORE operations, and alert on offsets and sizes that could produce a U32 wraparound.
   • If feasible, apply input validation at the application layer or via a proxy to reject STORE directives where the sum of offset and size exceeds the maximum U32 value or where the sum is less than either operand.
   • Isolate F´ deployments from untrusted networks and limit the attack surface by disabling FpySequencer if not required.

2. Patch/upgrade steps:

   • Upgrade to F´ version 4.2.0 or later, which contains the fix for this vulnerability. Verify the version after upgrade and ensure that the FpySequencer component is updated across all relevant deployments.
   • If upgrading is not immediately possible, consider applying a vendor-provided patch if one becomes available, or backporting the fix from the 4.2.0 release if you have access to the source and the capability to rebuild.

3. Long-term hardening:

   • Adopt a secure development lifecycle that includes integer overflow checks and safe bounds validation patterns. Use safe integer arithmetic functions or libraries that detect wraparound.
   • Implement comprehensive memory safety mitigations such as stack canaries, address space layout randomization (ASLR), and non-executable stack where supported by the embedded platform.
   • Conduct regular security audits and fuzz testing of sequence parsing and directive handling code.
   • Monitor F´ security advisories and CVE feeds for updates, and maintain an inventory of all embedded systems and their software versions.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92158
• F´ (F Prime) GitHub Repository: https://github.com/nasa/fprime
• F´ Release 4.2.0 (fix version): https://github.com/nasa/fprime/releases/tag/v4.2.0
• CWE-190: Integer Overflow or Wraparound: https://cwe.mitre.org/data/definitions/190.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-92158 not listed as of report date)
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.