PT-2026-2127 · Cryptolib · Cryptolib

Finder16 · Publicado 2026-01-10 · Atualizado 2026-01-15 · CVE-2026-21897

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software-only solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. The Crypto Config Add Gvcid Managed Parameters function does not adequately validate input, specifically only checking if gvcid counter is greater than GVCID MAN PARAM SIZE. This insufficient check allows for up to 251 entries, resulting in a write beyond the bounds of the gvcid managed parameters array array. This out-of-bounds write overwrites the gvcid counter variable, potentially impacting parameter lookup and registration logic that depends on its value.

Recommendations Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2026-21897

GHSA-9X7J-GX23-7M5R

Produtos afetados

Cryptolib

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21897.json · Exploit
• https://github.com/nasa/CryptoLib/security/advisories/GHSA-9x7j-gx23-7m5r · Aviso do Fabricante
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Nota
• https://twitter.com/cracbot/status/2011755290212045163 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2009846307176042712 · Publicação no Twitter
• https://t.me/CVEtracker/41886 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-21897 · Nota de Segurança
• https://t.me/cveNotify/148319 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-21897 · Aviso do Fabricante