CVE-2026-22697
Unknown Unknown - Not Provided
Heap Buffer Overflow in CryptoLib KMC Service Causes Crash

Publication date: 2026-01-10

Last updated on: 2026-01-10

Assigner: GitHub, Inc.

Description
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, CryptoLib’s KMC crypto service integration is vulnerable to a heap buffer overflow when decoding Base64-encoded ciphertext/cleartext fields returned by the KMC service. The decode destination buffer is sized using an expected output length (len_data_out), but the Base64 decoder writes output based on the actual Base64 input length and does not enforce any destination size limit. An oversized Base64 string in the KMC JSON response can cause out-of-bounds writes on the heap, resulting in process crash and potentially code execution under certain conditions. This issue has been patched in version 1.4.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-10
Last Modified
2026-01-10
Generated
2026-05-07
AI Q&A
2026-01-10
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
nasa cryptolib to 1.4.2 (inc)
nasa cryptolib 1.4.3
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a heap buffer overflow in the CryptoLib project's KMC crypto service integration when decoding Base64-encoded ciphertext or cleartext fields in JSON responses. The destination buffer for the decoded data is allocated based on an expected output length, but the Base64 decoder writes output based on the actual input length without enforcing size limits. If an oversized Base64 string is received, it can cause out-of-bounds writes on the heap, leading to heap corruption, process crashes, or potentially remote code execution under certain conditions. [2]


How can this vulnerability impact me? :

This vulnerability can cause a denial of service by crashing the process due to heap corruption. Additionally, under certain conditions, it may allow an attacker to execute arbitrary code remotely. The risk is higher if the application accepts malicious KMC responses, such as from a compromised KMC endpoint or a network attacker able to impersonate the endpoint, especially if TLS verification is weak. [2]


How can this vulnerability be detected on my network or system? Can you suggest some commands?

Detection can involve monitoring for process crashes or heap corruption symptoms in the CryptoLib KMC service, especially when handling Base64-encoded JSON responses. Using debugging tools like AddressSanitizer during testing can reveal heap-buffer-overflow errors in the base64Decode function. Additionally, inspecting network traffic for oversized Base64 strings in KMC JSON responses may help identify exploit attempts. Specific commands are not provided in the resources. [2]


What immediate steps should I take to mitigate this vulnerability?

The immediate mitigation step is to upgrade CryptoLib to version 1.4.3 or later, which includes a fix for this heap buffer overflow vulnerability. Additionally, ensure that the KMC crypto service is properly configured and that TLS verification is strong to prevent attackers from supplying malicious KMC JSON responses. [1, 2]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart