PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92156 nasa CVE debrief

A denial-of-service vulnerability exists in F´ (F Prime) EventManager when processing oversized LogBuffer values. This issue is fixed in version 4.3.0. The vulnerability is triggered when a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager's remaining log-argument budget, causing denial of service. Defenders should assess exposure and prioritize upgrading to version 4.3.0 or later. The CVE record and source item provide details on the vulnerability and its fix, but additional verification is required to confirm affected scope and severity.

Vendor
nasa
Product
fprime
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for F´ deployments should assess exposure and prioritize upgrading to version 4.3.0 or later to prevent denial-of-service due to oversized LogBuffer values in F´ EventManager. This includes verifying affected systems, reviewing compensating controls, and monitoring for oversized LogBuffer values.

Why it matters

Defenders should prioritize verifying exposure and upgrading to version 4.3.0 or later to prevent denial-of-service due to oversized LogBuffer values in F´ EventManager.

  • Denial of service due to process abortion or reset
  • Verification of exposure and upgrade to version 4.3.0 or later required

Technical summary

F´ EventManager is vulnerable to denial-of-service when processing oversized LogBuffer values. The issue is fixed in version 4.3.0. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager's remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. Defenders should prioritize verifying exposure and upgrading to version 4.3.0 or later to prevent denial-of-service.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 4.3.0 or later.

Recommended defensive actions

  • Verify if F´ versions prior to 4.3.0 are in use
  • Upgrade to F´ version 4.3.0 or later
  • Monitor for oversized LogBuffer values
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets
  • Review the supplied official advisory or CVE record to validate affected scope and severity

Evidence notes

The CVE record and source item provide details on the vulnerability and its fix. However, defenders should verify exposure and assess potential impact. The issue is fixed in version 4.3.0, but additional review is necessary to confirm affected systems and prioritize upgrades. Evidence limits and unknown affected scope require further investigation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92156 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92156

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92156 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92156

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard Generic

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92156.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nasa/fprime/pull/5633

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nasa/fprime/commit/7eacd551aaf6d9a21e347ac2c8d827ca15ee5755

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nasa/fprime/releases/tag/v4.3.0

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.