PT-2026-2131 · Cryptolib · Cryptolib

Enitmar + 1 · Publicado 2026-01-10 · Atualizado 2026-01-10 · CVE-2026-22023

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software-only solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft and a ground station. Versions prior to 1.4.3 contain an out-of-bounds heap read issue within the cryptography aead encrypt() function. The issue stems from a flawed strtok pattern during KMC AEAD encrypt metadata parsing.

Recommendations Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2026-22023

GHSA-8W3H-Q8JM-3CHQ

Produtos afetados

Cryptolib

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22023.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-8w3h-q8jm-3chq · Exploit
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Nota
• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d · Correção
• https://t.me/cveNotify/148323 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-22023 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-22023 · Aviso do Fabricante
• https://t.me/CVEtracker/41890 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2009818083062337674 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2009846303132615000 · Publicação no Twitter