The vulnerability arises from an unchecked arithmetic operation in the FileDownlink component of F Prime, where adding the startOffset and length can wrap around and bypass range validation. When a caller sends a SendPartial command with a legal offset but a length that causes the sum to wrap below the source file size, the calculated end offset becomes inconsistent with the byte offset, triggering an assertion during packet handling. This aborts or resets the process, effectively denying service for the affected application component.

Spaceflight and other embedded software that rely on the NASA F Prime framework, specifically any installation using a version earlier than 4.3.0. The issue has been fixed in release 4.3.0 and later. Users of older versions that compile the Svc::FileDownlink service are affected.

The CVSS score of 6.5 indicates moderate severity. The EPSS score indicates a probability of exploitation of less than 1%, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is the operator or an authenticated user supplying a crafted SendPartial command; this is inferred from the description stating that the vulnerability is triggered by providing a length that wraps the offset. Successful exploitation would lead to a denial of service, impacting availability of the target component.