The vulnerability exists in F Prime's Svc::FileUplink component’s handleDataPacket routine, where byteOffset and dataSize are added using wrapping unsigned 32‑bit arithmetic before comparison to the declared file size. An attacker can supply a DATA packet with a byteOffset and dataSize that wrap around, causing the component to seek to an offset beyond the intended file boundary and write data beyond the defined upload size. This can corrupt the target file and lead to large sparse files, potentially exhausting storage resources. The weakness is identified as an unsigned integer overflow (CWE‑190).

The flaw affects the F Prime framework prior to version 4.2.0, specifically the Svc::FileUplink component. Systems using F Prime 4.1.x or earlier that expose a file uplink interface are vulnerable. The issue is fixed in F Prime 4.2.0 and later releases.

The CVSS base score is 8.1, indicating high severity. EPSS score is less than 1%, indicating a very low but non-zero exploitation probability, and the vulnerability has not been listed in the CISA KEV catalog. An attacker would need the ability to send a custom file‑uplink DATA packet to an F Prime instance that accepts uplink commands, which is typically a remote network interface. Once the packet is processed, the vulnerable arithmetic allows overwriting data beyond the intended file boundary, potentially corrupting files or causing uncontrolled disk usage. Because the vulnerability resides in user controllable input, exploitation is likely possible when the interface is reachable from an untrusted network or user.