CVE-2026-22697
Heap Buffer Overflow in CryptoLib KMC Service Causes Crash
Publication date: 2026-01-10
Last updated on: 2026-01-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nasa | cryptolib | to 1.4.2 (inc) |
| nasa | cryptolib | 1.4.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap buffer overflow in the CryptoLib project's KMC crypto service integration when decoding Base64-encoded ciphertext or cleartext fields in JSON responses. The destination buffer for the decoded data is allocated based on an expected output length, but the Base64 decoder writes output based on the actual input length without enforcing size limits. If an oversized Base64 string is received, it can cause out-of-bounds writes on the heap, leading to heap corruption, process crashes, or potentially remote code execution under certain conditions. [2]
How can this vulnerability impact me? :
This vulnerability can cause a denial of service by crashing the process due to heap corruption. Additionally, under certain conditions, it may allow an attacker to execute arbitrary code remotely. The risk is higher if the application accepts malicious KMC responses, such as from a compromised KMC endpoint or a network attacker able to impersonate the endpoint, especially if TLS verification is weak. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for process crashes or heap corruption symptoms in the CryptoLib KMC service, especially when handling Base64-encoded JSON responses. Using debugging tools like AddressSanitizer during testing can reveal heap-buffer-overflow errors in the base64Decode function. Additionally, inspecting network traffic for oversized Base64 strings in KMC JSON responses may help identify exploit attempts. Specific commands are not provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade CryptoLib to version 1.4.3 or later, which includes a fix for this heap buffer overflow vulnerability. Additionally, ensure that the KMC crypto service is properly configured and that TLS verification is strong to prevent attackers from supplying malicious KMC JSON responses. [1, 2]