CVE-2026-41144: F Prime FileUplink Integer Overflow Enabling Arbitrary File Write

Overview

F Prime (F´) is a framework for building spaceflight and other embedded software. The advisory-derived record describes an integer overflow in the bounds check used by the FileUplink component. The check uses 32-bit unsigned arithmetic that can wrap around, which the record says allows a crafted input to bypass the check. The record also notes that the destination file path in the same component is not sanitized.

Impact

• The record states that the combined weaknesses allow writing arbitrary data to files at arbitrary offsets.
• The record states that this may lead to remote code execution on embedded targets. This consequence is not independently verified in the sources consulted.
• The record notes that the issue is a logic flaw in file I/O that memory-safety tools such as ASAN do not detect.
• NVD lists a CVSS base score of 9.8 with a critical severity label. The record also lists zero-valued scores from GitHub-related providers, which this analysis does not treat as valid scores.

Affected products and versions

• NASA F Prime (listed as Nasa Fprime), version 4.1.1.
• NASA F Prime, versions before 4.2.0.
• The record indicates that version 4.2.0 contains the patch.

Exploitation status

• The CISA KEV catalog entry for this CVE is not listed in the record.
• The record lists an EPSS probability of 0.00772 and a percentile of 0.55221.
• The record lists SSVC exploitation as none.
• No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Upgrade F Prime to version 4.2.0 or later, which the record identifies as containing the patch.
• Review the upstream commit and the GitHub security advisory for the fix details.
• The record states that no known workarounds are available. Until patching is complete, limiting network exposure of the file uplink interface to trusted sources is a general defensive measure, not a verified workaround from the sources.
• Plan validation of the affected firmware or software build after the update.

Detection guidance

• Monitor for unexpected file creation or modification in flight software or embedded file storage, particularly writes initiated through the uplink path.
• Compare file integrity against known-good baselines after receiving file transfers from external or untrusted interfaces.
• Review logs of file uplink activity for transfers that do not match expected operational procedures.

Limitations of the available information

• The record does not state which deployments or configurations are exposed to the uplink interface.
• The record does not provide independent verification of the remote code execution outcome.
• The EPSS date in the record (2026-10-23) is later than the publication date (2026-04-22), so its reliability is unknown.
• Affected version strings are limited to those stated in the record.

Frequently asked questions

Which F Prime versions are affected by CVE-2026-41144?

The record lists version 4.1.1 and versions before 4.2.0 as affected. The record states that version 4.2.0 contains a patch.

Is CVE-2026-41144 known to be actively exploited?

The record shows the CVE is not listed in CISA KEV and that no confirmed exploitation appears in the sources consulted. The record lists an EPSS probability of 0.00772.

What should operators do now?

Upgrade to version 4.2.0 or later, as stated in the record. The record says no known workarounds are available, so restricting network exposure of the uplink interface is a general defensive measure to consider while patching.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.