Read the docs
TI-2026-17600 Aliases CVE-2026-21900

CryptoLib Has Out-of-Bounds Read in KMC Encrypt Metadata Parsing via Flawed strtok Pattern

Priority HIGH 75CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, an out-of-bounds heap read vulnerability in cryptography_encrypt() occurs when parsing JSON metadata from KMC server responses. The flawed strtok iteration pattern uses ptr + strlen(ptr) + 1 which reads one byte past allocated buffer boundaries when processing short or malformed metadata strings. This issue has been patched in version 1.4.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00598 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed CryptoLib (nasa): 1.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nasaCryptoLibbefore 1.4.31.4.3Patch availableCNA
  • CryptoLib Vendornasa Affected before 1.4.3 Fixed in 1.4.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nasa:cryptolib:*:*:*:*:*:*:*:*before 1.4.3Vulnerablenasa
  • cpe:2.3:a:nasa:cryptolib:*:*:*:*:*:*:*:* Versions before 1.4.3 Vulnerable ·nasa

Remediation

  • Fix · CNA CryptoLib (nasa) Fixed in 1.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21900

References

Exploit 1

Patch 1

Other 1

  • TI-2025-21552 CryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header Length CVSS 3.1CRITICAL 9.4
  • TI-2025-21662 Heap Buffer Overflow via Incomplete Length Check in `Crypto_TC_ApplySecurity` CVSS 4.0CRITICAL 9.3
  • TI-2025-21298 CryptoLib's Crypto_TC_Prep_AAD Has Buffer Overflow Due to Integer Underflow CVSS 4.0HIGH 8.9
  • TI-2025-21297 CryptoLib Has Heap Buffer Overflow Due to Unsigned Integer Underflow in Crypto_TC_ProcessSecurity CVSS 4.0HIGH 8.9
  • TI-2025-21296 CryptoLib Has Heap Buffer Overflow in Crypto_AOS_ProcessSecurity Function CVSS 4.0HIGH 8.9
  • TI-2025-21294 CryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow Vulnerability CVSS 4.0HIGH 8.9
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences