Prior to version 4.2.0 of the FPrime framework, the deserialization routine in Svc::FileUplink expected a packet type byte that matched a defined enumeration. The code cast the byte directly to the Type enum without verifying the value was within range. When an unknown type value was received, the routine triggered a default assertion, causing the application to abort or reset the default Ref process. The vulnerability is a classic unchecked cast leading to an assertion failure and a denial of service. The weakness can be mapped to CWE‑617.

The affected product is NASA FPrime, a framework for developing spaceflight and embedded software. All releases prior to 4.2.0 are impacted; the vulnerability was addressed in the 4.2.0 release.

The CVSS score of 7.5 indicates a significant impact magnitude. The EPSS score is 0.00366 (<1%), and the issue is not currently listed in CISA’s KEV catalog, suggesting no known public exploits have been documented. The likely attack vector is over a network channel where a malicious entity can send a crafted file packet to an instance of Svc::FileUplink. An attacker able to reach the upload endpoint can force the process to abort or reset, resulting in a denial of service. The risk remains high for unpatched installations, especially those exposed to external networks.