PT-2026-2129 · Cryptolib · Cryptolib

Luiginoc · CVE-2026-21899 · Published 2026-01-10 · Updated 2026-01-10

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software solution that uses the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft and a ground station. Prior to version 1.4.3, the base64urlDecode function contains a flaw where padding-stripping dereferences input data before verifying its validity. Specifically, it accesses input[inputLen - 1] before confirming that inputLen is greater than zero or that input is not NULL. If inputLen is zero, this results in an out-of-bounds read at input[-1], potentially causing the process to crash. If input is NULL and inputLen is zero, a dereference of NULL - 1 occurs.

Recommendations Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-21899

GHSA-WC29-5HW7-MPJ8

Affected Products

Cryptolib

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21899.json · Exploit
• https://github.com/nasa/CryptoLib/security/advisories/GHSA-wc29-5hw7-mpj8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21899 · Security Note
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Note
• https://twitter.com/VulmonFeeds/status/2009823203112231298 · Twitter Post
• https://twitter.com/CVEnew/status/2009846305288532098 · Twitter Post
• https://t.me/cveNotify/148321 · Telegram Post
• https://t.me/CVEtracker/41888 · Telegram Post