PT-2026-2130 · Cryptolib · Cryptolib

Enitmar + 1 · Publicado 2026-01-10 · Atualizado 2026-01-17 · CVE-2026-21900

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft and a ground station. An out-of-bounds heap read issue exists in the cryptography encrypt() function when processing JSON metadata received from KMC server responses. The problem stems from a flawed iteration pattern within the strtok function, specifically ptr + strlen(ptr) + 1, which can read one byte beyond the allocated buffer when handling short or malformed metadata strings.

Recommendations Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2026-21900

GHSA-4G6V-36FV-QCVW

Produtos afetados

Cryptolib

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21900.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-4g6v-36fv-qcvw · Exploit
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Nota
• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d · Correção
• https://twitter.com/geeknik/status/2012630755478757694 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2009846304248320263 · Publicação no Twitter
• https://t.me/cveNotify/148322 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-21900 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2009820643005493332 · Publicação no Twitter
• https://t.me/CVEtracker/41889 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-21900 · Nota de Segurança