Read the docs
TI-2025-34612 Aliases CVE-2025-54878

Heap Buffer Overflow in NASA CryptoLib 1.4.0 `Crypto_TC_Check_IV_Setup`

Priority HIGH 76CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A heap buffer overflow vulnerability exists in NASA CryptoLib version 1.4.0 and prior in the IV setup logic for telecommand frames. The problem arises from missing bounds checks when copying the Initialization Vector (IV) into a freshly allocated buffer. An attacker can supply a crafted TC frame that causes the library to write one byte past the end of the heap buffer, leading to heap corruption and undefined behaviour. An attacker supplying a malformed telecommand frame can corrupt heap memory. This leads to undefined behaviour, which could manifest itself as a crash (denial of service) or more severe exploitation. This issue has been patched in version 1.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00412 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed CryptoLib (nasa): 1.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nasaCryptoLibbefore 1.4.11.4.1Patch availableCNA
  • CryptoLib Vendornasa Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nasa:cryptolib:*:*:*:*:*:*:*:*before 1.4.1Vulnerablenasa
  • cpe:2.3:a:nasa:cryptolib:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·nasa

Remediation

  • Fix · CNA CryptoLib (nasa) Fixed in 1.4.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54878

References

Exploit 1

Patch 1

  • TI-2025-21552 CryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header Length CVSS 3.1CRITICAL 9.4
  • TI-2025-21662 Heap Buffer Overflow via Incomplete Length Check in `Crypto_TC_ApplySecurity` CVSS 4.0CRITICAL 9.3
  • TI-2025-21298 CryptoLib's Crypto_TC_Prep_AAD Has Buffer Overflow Due to Integer Underflow CVSS 4.0HIGH 8.9
  • TI-2025-21297 CryptoLib Has Heap Buffer Overflow Due to Unsigned Integer Underflow in Crypto_TC_ProcessSecurity CVSS 4.0HIGH 8.9
  • TI-2025-21296 CryptoLib Has Heap Buffer Overflow in Crypto_AOS_ProcessSecurity Function CVSS 4.0HIGH 8.9
  • TI-2025-21294 CryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow Vulnerability CVSS 4.0HIGH 8.9
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences