CVE-2026-21900: fallo de gravedad alta en nasa CryptoLib
CryptoLib Has Out-of-Bounds Read in KMC Encrypt Metadata Parsing via Flawed strtok Pattern
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.6%
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, an out-of-bounds heap read vulnerability in cryptography_encrypt() occurs when parsing JSON metadata from KMC server responses. The flawed strtok iteration pattern uses ptr + strlen(ptr) + 1 which reads one byte past allocated buffer boundaries when processing short or malformed metadata strings. This issue has been patched in version 1.4.3.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
nasa · CryptoLibCVEs relacionadas — nasa CryptoLib
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-30216CRITICALCryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header LengthEPSS 2.6%CVE-2025-29912HIGHCryptoLib Has Heap Buffer Overflow Due to Unsigned Integer Underflow in Crypto_TC_ProcessSecurityEPSS 1.1%CVE-2025-29909HIGHCryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow VulnerabilityEPSS 1.1%CVE-2025-59534HIGHCryptoLib command Injection vulnerability in initialize_kerberos_keytab_file_login()EPSS 0.9%CVE-2025-29911HIGHCryptoLib Has Heap Buffer Overflow in Crypto_AOS_ProcessSecurity FunctionEPSS 0.7%CVE-2025-29913HIGHCryptoLib's Crypto_TC_Prep_AAD Has Buffer Overflow Due to Integer UnderflowEPSS 0.7%