CVE-2026-21897
HighSummary
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_Config_Add_Gvcid_Managed_Parameters function only checks whether gvcid_counter > GVCID_MAN_PARAM_SIZE. As a result, it allows up to the 251st entry, which causes a write past the end of the array, overwriting gvcid_counter located immediately after gvcid_managed_parameters_array[250]. This leads to an out-of-bounds write, and the overwritten gvcid_counter may become an arbitrary value, potentially affecting the parameter lookup/registration logic that relies on it. This issue has been patched in version 1.4.3.
Risk Assessment
The vulnerability could lead to memory corruption and potential code execution or system disruption, potentially compromising space communication security.
Recommendation
Update CryptoLib to version 1.4.3 or later to fix the out-of-bounds write issue.
Other vulnerabilities in CryptoLib
See all- CVE-2026-22697High
CryptoLib before version 1.4.3 contains a heap buffer overflow vulnerability when decoding Base64 fields in JSON responses from the KMC service. The destination buffer is sized based on expected output length, but the Base64 decoder writes based on actual input length, allowing out-of-bounds writes.
- CVE-2026-22026High
CryptoLib before version 1.4.3 contains a vulnerability in the write_callback function of the KMC crypto service client, which does not limit the size of HTTP response buffers. A malicious KMC server can send an arbitrarily large response, causing unbounded memory growth and process termination by the OS.
- CVE-2026-22023High
CryptoLib prior to version 1.4.3 contains an out-of-bounds heap read vulnerability in the cryptography_aead_encrypt() function. The issue has been fixed in version 1.4.3.
- CVE-2026-21898High
CryptoLib before version 1.4.3 contains a vulnerability involving memory read without proper bounds checking when parsing AOS frame hashes. The issue has been fixed in version 1.4.3.
Original NVD description (English source)
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_Config_Add_Gvcid_Managed_Parameters function only checks whether gvcid_counter > GVCID_MAN_PARAM_SIZE. As a result, it allows up to the 251st entry, which causes a write past the end of the array, overwriting gvcid_counter located immediately after gvcid_managed_parameters_array[250]. This leads to an out-of-bounds write, and the overwritten gvcid_counter may become an arbitrary value, potentially affecting the parameter lookup/registration logic that relies on it. This issue has been patched in version 1.4.3.