PT-2026-2130 · Cryptolib · Cryptolib

Enitmar + 1 · Published 2026-01-10 · Updated 2026-01-17 · CVE-2026-21900

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft and a ground station. An out-of-bounds heap read issue exists in the cryptography encrypt() function when processing JSON metadata received from KMC server responses. The problem stems from a flawed iteration pattern within the strtok function, specifically ptr + strlen(ptr) + 1, which can read one byte beyond the allocated buffer when handling short or malformed metadata strings.

Recommendations Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-21900

GHSA-4G6V-36FV-QCVW

Affected Products

Cryptolib

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21900.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-4g6v-36fv-qcvw · Exploit
• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d · Patch
• https://osv.dev/vulnerability/CVE-2026-21900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21900 · Security Note
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Note
• https://twitter.com/geeknik/status/2012630755478757694 · Twitter Post
• https://twitter.com/CVEnew/status/2009846304248320263 · Twitter Post
• https://t.me/cveNotify/148322 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009820643005493332 · Twitter Post
• https://t.me/CVEtracker/41889 · Telegram Post