PT-2025-11564 · Cryptolib · Cryptolib

Mirkobitetto

·

Published

2025-03-17

·

Updated

2025-05-07

·

CVE-2025-29912

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions CryptoLib versions 1.3.3 and prior
Description The issue is caused by an unsigned integer underflow in the Crypto TC ProcessSecurity function of CryptoLib, leading to a heap buffer overflow. This occurs when the fl (frame length) field in a Telecommand (TC) packet is set to 0, causing the frame length to be interpreted as 65535 and resulting in out-of-bounds memory access. This critical issue can be exploited to cause a denial of service (DoS) or potentially achieve remote code execution.
Recommendations For CryptoLib versions 1.3.3 and prior, apply the recommended patch or avoid processing untrusted TC packets until a fix is available. As a temporary workaround, consider disabling the Crypto TC ProcessSecurity function until a patch is available. Restrict access to untrusted TC packets to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Integer Underflow

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

Related Identifiers

CVE-2025-29912
GHSA-3F5X-R59X-P8CF

Affected Products

Cryptolib