PT-2026-2127 · Cryptolib · Cryptolib

Finder16 · Published 2026-01-10 · Updated 2026-01-15 · CVE-2026-21897

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software-only solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. The Crypto Config Add Gvcid Managed Parameters function does not adequately validate input, specifically only checking if gvcid counter is greater than GVCID MAN PARAM SIZE. This insufficient check allows for up to 251 entries, resulting in a write beyond the bounds of the gvcid managed parameters array array. This out-of-bounds write overwrites the gvcid counter variable, potentially impacting parameter lookup and registration logic that depends on its value.

Recommendations Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-21897

GHSA-9X7J-GX23-7M5R

Affected Products

Cryptolib

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21897.json · Exploit
• https://github.com/nasa/CryptoLib/security/advisories/GHSA-9x7j-gx23-7m5r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21897 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21897 · Vendor Advisory
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Note
• https://twitter.com/cracbot/status/2011755290212045163 · Twitter Post
• https://twitter.com/CVEnew/status/2009846307176042712 · Twitter Post
• https://t.me/CVEtracker/41886 · Telegram Post
• https://t.me/cveNotify/148319 · Telegram Post