The vulnerability is a lack of bounds checking on a port index used by the GenericHub output‑port dispatch. An attacker who supplies a hub packet with an index outside the configured array can trigger an assertion failure in builds that enable assertions, or overwrite memory out of bounds in builds that do not. This heap corruption could be leveraged to execute arbitrary code on the host system.

The issue affects NASA’s F Prime framework (Svc::GenericHub) in all releases from 4.1.0 through 4.1.x, up to but not including 4.2.0. Any system deploying these versions is vulnerable; version 4.2.0 and later contain the fix.

The CVSS score is 9.3, indicating critical impact. The EPSS score is 0.0067, indicating a very low yet non‑zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The flaw is exploitable over the network via a specially crafted hub packet, and requires no local user interaction. Because the defect allows arbitrary memory write, a remote attacker could achieve code execution once the packet is processed under a vulnerable build.