PT-2026-34226 · F Prime · Fprime

Lowbitwarrior · CVE-2026-41144 · Published 2026-04-21 · Updated 2026-05-21

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F Prime versions prior to 4.2.0

Description An integer overflow occurs during a bounds check where the addition of byteOffset and dataSize wraps around on overflow. This allows a specially crafted DataPacket to bypass the check, enabling a file write at an unintended offset. Furthermore, the destination file path in 'Svc/FileUplink/File.cpp' is not sanitized. Together, these issues allow writing arbitrary data to any file at any offset, which can lead to remote code execution on embedded targets.

Recommendations Update to version 4.2.0.

Exploit

Fix

RCE

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

CVE-2026-41144

GHSA-QMVV-RXH4-CCQH

Affected Products

Fprime

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41144.json · Exploit
• https://github.com/nasa/fprime/commit/cacdd555456bd83ab395b521d56c0330470ea798 · Patch
• https://github.com/nasa/fprime/security/advisories/GHSA-qmvv-rxh4-ccqh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41144 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41144 · Vendor Advisory
• https://twitter.com/CVEnew/status/2048168397452767719 · Twitter Post
• https://t.me/cveNotify/164430 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2046820198431265260 · Twitter Post