The flaw occurs when the Svc::FpySequencer component adds an attacker‑controlled stack offset and size together before performing a memcpy. The 32‑bit unsigned sum can wrap around so that the calculated destination address appears within bounds, but in reality it lies outside the intended stack area. The subsequent memcpy writes beyond the allocated stack space, corrupting memory, causing system instability, and potentially enabling execution of arbitrary code if the corruption is exploited. This is strictly an integer wraparound followed by an out‑of‑bounds write, as identified by CWE‑190 and CWE‑787.

The vulnerability affects the NASA FPrime flight software framework in all releases prior to version 4.2.0 that include the Svc::FpySequencer component. No specific hardware vendor is mentioned, but any deployment of the FPrime framework before 4.2.0 is potentially impacted.

The CVSS score of 7.2 places this issue in the high severity range. The EPSS score is 0.00747, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nevertheless, because the fault allows an out‑of‑bounds memory write that can corrupt critical internal data structures, an adversary with access to the sequence configuration or with the ability to deliver malicious sequence files could trigger a denial of service or even arbitrary code execution. The attack vector likely requires local or privileged access to the stored sequence data, though remote exploitation cannot be ruled out if the system allows upload of arbitrary sequences over insecure channels. Given the potentially severe impact and moderate probability, organizations should treat this as a priority for remediation.