PT-2026-2135 · Cryptolib+1 · Cryptolib+1

Enitmar + 1 · Publicado 2026-01-10 · Atualizado 2026-01-10 · CVE-2026-22027

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software solution that uses the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft and a ground station. The convert hexstring to byte array() function within the MariaDB SA interface lacks a capacity check when writing decoded bytes into a caller-provided buffer. This can lead to a heap buffer overflow when importing SA fields (e.g., IV, ARSN, ABM) from the database if a malformed or oversized hex string is present. The vulnerable function is convert hexstring to byte array().

Recommendations Update to CryptoLib version 1.4.3 or later.

Exploit

Correção

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-122

Identificadores relacionados

CVE-2026-22027

GHSA-3M35-M689-H29X

Produtos afetados

Cryptolib

Mariadb

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22027.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-3m35-m689-h29x · Exploit
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Nota
• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-22027 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2009807844430762313 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-22027 · Aviso do Fabricante
• https://t.me/CVEtracker/41894 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2009846298883842210 · Publicação no Twitter