CVE-2026-41144 is an integer overflow in NASA F Prime FileUplink that bypasses a bounds check and allows file writes at arbitrary offsets. The advisory says versions before 4.2.0 are affected and 4.2.0 patches it. Upgrade, and review how uplinked file paths are handled.
What's affected
- Affected: F Prime v4.1.1 per the advisory table, and prior to 4.2.0 per the record
- Fixed: 4.2.0 (the advisory lists v4.2)
- Workarounds: the advisory says none are known
The advisory names Svc/FileUplink/FileUplink.cpp, where a 32 bit addition used in a bounds check wraps around. A data packet with an offset near the top of the 32 bit range and a small size adds to zero and passes the check, and the write then goes to the original large offset. It also notes the destination path in Svc/FileUplink/File.cpp is not sanitized.
One oddity in the record: the CVSS vector shows no impact values, so the base score reads 0.0, and the GitHub page shows severity low. Do not rely on that number. The advisory text describes arbitrary file write that can lead to code execution on embedded targets.
How to check if you're exposed
If you build flight or embedded software on F Prime, check the framework version recorded in your project, which is usually a git submodule or a pinned tag:
git submodule status | grep -i fprime
Then check whether your deployment includes the FileUplink component and who can send file uplink packets to it. Review how uplink destination paths are constrained in your deployment.
What to do now
- Upgrade F Prime to 4.2.0 or later and rebuild your deployments.
- Check whether FileUplink is part of your topology and what can reach it.
- Restrict file uplink to authenticated, trusted ground systems.
- Validate destination paths against an allowed directory in your own code.
- Note that fixes require reflashing, so plan the schedule.
Why it matters
The weaknesses are CWE-190, integer overflow, and CWE-787, out of bounds write. The advisory notes that address sanitizers do not catch this, because every memory access stays inside valid buffers and the damage happens in file input and output. That is a useful warning for testing: some bugs only show up as logic failures at the file or protocol level.
On embedded targets, an arbitrary file write can mean changing configuration or code that runs later. The record does not flag exploitation in the wild.
Quick check
Why does the score show 0.0?
The vector in the record has no impact values set, which yields zero. The advisory text describes serious impact, so judge by the text.
Sources
Last reviewed: 19 October 2026.
