CVE-2026-92159

Name of the Vulnerable Software and Affected Versions F´ (F Prime) versions prior to 4.3.0

Description In the Svc::TlmPacketizer component, the TlmRecv handler function performs a fixed-slot copy of val.getSize bytes into entry.channelSize storage without verifying if the runtime value fits. If a telemetry update for a configured channel contains a serialized value larger than the fixed slot of that channel, the copy operation overwrites adjacent channel fields, resulting in the emission of corrupted packetized telemetry.

Recommendations Update to version 4.3.0.