Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-21898

CryptoLib Has Out-of-bounds Read in Crypto_AOS_ProcessSecurity

Description

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_AOS_ProcessSecurity function reads memory without valid bounds checking when parsing AOS frame hashes. This issue has been patched in version 1.4.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nasa CryptoLib

  • < 1.4.3affected

References