Heap Buffer Overflow Vulnerability in NASA CryptoLib Software

CVE-2025-54878

What is CVE-2025-54878?

NASA's CryptoLib library, which implements the CCSDS Space Data Link Security Protocol for securing communications between spacecraft and ground stations, is vulnerable to a heap buffer overflow. This flaw is present in the IV setup logic for telecommand frames in versions prior to 1.4.0. The vulnerability results from insufficient bounds checks when copying the Initialization Vector (IV), allowing attackers to craft malicious telecommand frames that may overwrite memory beyond the intended buffer limits. This condition can lead to heap corruption, resulting in unpredictable behavior such as crashes or potential exploitation of the system.

References