A buffer copy in the I/O layer of the F Prime telemetry packetizing function reads a serialized telemetry value into a fixed channel buffer without size validation. When the incoming value exceeds the allocated channel slot, the unchecked copy overruns adjacent fields, resulting in corrupted packetized telemetry. The corrupted output can misrepresent spacecraft telemetry data, potentially leading to incorrect status interpretation or mission‑critical control decisions.

The vulnerability affects the F Prime framework from NASA, specifically any deployment built with a version older than 4.3.0. The fix is included in releases 4.3.0, 4.3.0a1, and later. Systems utilizing Svc::TlmPacketizer in these prior releases are therefore impacted.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of < 1% indicates a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can influence the telemetry input payload—for example, through maintenance consoles or compromised onboard software—can trigger the overflow and produce corrupted telemetry. It is also inferred that the vulnerability does not rely on network exposure and that the exploit may require local or remote code execution within the telemetry processing context. Given the moderate score, careful monitoring and timely patching are recommended.