CVE-2026-22697

{"id": "CVE-2026-22697", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22697", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T21:48:35.288004Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nasa", "product": "CryptoLib", "versions": [{"status": "affected", "version": "< 1.4.3"}]}]}], "published": "2026-01-10T01:16:19.160", "references": [{"url": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, CryptoLib\u2019s KMC crypto service integration is vulnerable to a heap buffer overflow when decoding Base64-encoded ciphertext/cleartext fields returned by the KMC service. The decode destination buffer is sized using an expected output length (len_data_out), but the Base64 decoder writes output based on the actual Base64 input length and does not enforce any destination size limit. An oversized Base64 string in the KMC JSON response can cause out-of-bounds writes on the heap, resulting in process crash and potentially code execution under certain conditions. This issue has been patched in version 1.4.3."}, {"lang": "es", "value": "CryptoLib proporciona una soluci\u00f3n \u00fanicamente de software utilizando el Protocolo de Seguridad de Enlace de Datos Espaciales CCSDS - Procedimientos Extendidos (SDLS-EP) para asegurar las comunicaciones entre una nave espacial que ejecuta el Sistema de Vuelo central (cFS) y una estaci\u00f3n terrestre. Antes de la versi\u00f3n 1.4.3, la integraci\u00f3n del servicio criptogr\u00e1fico KMC de CryptoLib es vulnerable a un desbordamiento de b\u00fafer de pila al decodificar campos de texto cifrado/texto claro codificados en Base64 devueltos por el servicio KMC. El b\u00fafer de destino de decodificaci\u00f3n se dimensiona utilizando una longitud de salida esperada (len_data_out), pero el decodificador Base64 escribe la salida bas\u00e1ndose en la longitud real de la entrada Base64 y no impone ning\u00fan l\u00edmite de tama\u00f1o de destino. Una cadena Base64 sobredimensionada en la respuesta JSON del KMC puede causar escrituras fuera de l\u00edmites en la pila, lo que resulta en un fallo del proceso y potencialmente la ejecuci\u00f3n de c\u00f3digo bajo ciertas condiciones. Este problema ha sido parcheado en la versi\u00f3n 1.4.3."}], "lastModified": "2026-06-17T10:20:15.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nasa:cryptolib:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE1BE91E-2901-42AF-BC66-762CFA7A2582", "versionEndExcluding": "1.4.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}