PT-2026-2131 · Cryptolib · Cryptolib

Enitmar + 1 · Published 2026-01-10 · Updated 2026-01-10 · CVE-2026-22023

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software-only solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft and a ground station. Versions prior to 1.4.3 contain an out-of-bounds heap read issue within the cryptography aead encrypt() function. The issue stems from a flawed strtok pattern during KMC AEAD encrypt metadata parsing.

Recommendations Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-22023

GHSA-8W3H-Q8JM-3CHQ

Affected Products

Cryptolib

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22023.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-8w3h-q8jm-3chq · Exploit
• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22023 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22023 · Vendor Advisory
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Note
• https://t.me/cveNotify/148323 · Telegram Post
• https://t.me/CVEtracker/41890 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009818083062337674 · Twitter Post
• https://twitter.com/CVEnew/status/2009846303132615000 · Twitter Post