Memory Bounds Checking Flaw in CryptoLib for Spacecraft Communication
CVE-2026-21898

8.2HIGH

Key Information:

Vendor

Nasa

Status
Cryptolib
Vendor
CVE Published:
10 January 2026

What is CVE-2026-21898?

The CryptoLib library, utilized for securing communications between spacecraft and ground stations via the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP), contains a vulnerability in the Crypto_AOS_ProcessSecurity function. This flaw allows for memory reads without valid bounds checking when parsing AOS frame hashes, potentially compromising the integrity of the system. This issue has been addressed in version 1.4.3 of CryptoLib. Users are advised to upgrade to this version to ensure secure communications.

Affected Version(s)

CryptoLib < 1.4.3

References

https://github.com/nasa/CryptoLib/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/nasa/CryptoLib/releases/tag/v1.4.3
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.