The vulnerability arises when the SpacePacketDeframer in F Prime treats a packet that contains six bytes or fewer as a failure condition by triggering a framework assertion. The assertion causes the flight‑software process to abort or reset, thereby bringing the affected system offline. The flaw is limited to handling of CCSDS telecommand frames and does not directly expose remote code execution or data confidentiality loss, but it does allow a remote sender to drive the spacecraft software into an unrecoverable state.

The affected product is the NASA F Prime framework. All releases before version 4.2.0 contain the flaw. Version 4.2.0 and later include a patch that changes the logic to reject short packets instead of asserting, preventing the denial of service. The framework is used to develop and deploy spaceflight and other embedded software applications.

The CVSS score of 7.5 indicates a high severity of this denial of service. The EPSS score is <1%, showing a very low exploitation probability. The vulnerability has not been listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is the injection of a CCSDS telecommand frame that contains a payload of six bytes or fewer during an active telecommunications session. An attacker would need network or ground‑system access to send such frames to the spacecraft or satellite processor.