CVE-2026-41144

In F´ (F Prime) from 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution.

In F´ (F Prime) prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because a wrapping sum bypasses the range check, becomes m_endOffset, and leaves m_byteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a length causes the U32 sum to wrap, the first data-packet send reaches FW_ASSERT and aborts or resets the process.

In F´ (F Prime) prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler copies val.getSize bytes into fixed-slot entry.channelSize storage without confirming the runtime value fits. When a telemetry update for a configured channel carries a larger serialized value, it overwrites adjacent channel fields and emits corrupted packetized telemetry.

F´ (F Prime) before version 4.2.0 has a vulnerability in the Svc::FpySequencer STORE directive stack write validation. The bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid.

In F´ (F Prime) prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset inconsistent with m_byteOffset. When the source file is larger than a valid startOffset and a length causes the U32 sum to wrap below the file size, the first data-packet transition reaches FW_ASSERT and aborts or resets the process.

In F´ (F Prime) prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer, leaving a smaller budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than the remaining budget, standard assertion handling aborts or resets the process.

F´ (F Prime) before version 4.2.0 has a vulnerability in Fw::FilePacket deserialization used by Svc::FileUplink. Header deserialization casts the byte to the Type enum without validating its range, and FilePacket::fromSerialBuffer reaches a default FW_ASSERT when a network file packet contains an unknown file-packet type byte.

F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::FileUplink handleDataPacket offset and size validation. The component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing.

F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::GenericHub fromBufferDriver_handler deserialization. The receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow.

F´ (F Prime) prior to 4.3.0 has a vulnerability in Svc::FileUplink where the destination path from a StartPacket is copied and opened for writing without canonicalization or confinement to an upload directory. This allows creating or overwriting files at attacker-selected locations.