CVE-2026-75369 in SpaceDot
Summary
by MITRE • 08/24/2026
An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted CAN message.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The identified vulnerability resides within the Can Application layer of the On-Board Computer software for the SpaceDot AcubeSat, specifically in the parsePerformFunctionMessage component. This module is responsible for interpreting and processing incoming Controller Area Network messages that trigger specific operational functions on the satellite. The core technical flaw is an out-of-bounds read condition, which occurs when the software fails to adequately validate the length or bounds of data contained within a received CAN message before accessing memory locations associated with that data. In embedded systems like those used in CubeSats, such validation errors are particularly critical because they can lead to unpredictable behavior depending on what adjacent memory contents are accessed. An attacker who has access to the communication bus can exploit this flaw by transmitting a specially crafted CAN frame where the payload length or structure exceeds the expected limits defined by the application logic.
When the parsePerformFunctionMessage routine processes this malformed input, it attempts to read data from memory addresses that lie outside the allocated buffer boundaries. This out-of-bounds access does not necessarily result in arbitrary code execution due to the nature of a read operation rather than a write, but it frequently leads to the corruption of internal state variables or the retrieval of sensitive information stored in adjacent memory regions. More commonly in this context, the immediate consequence is a Denial of Service condition. The invalid memory access can trigger hardware exceptions such as bus errors or segmentation faults within the microcontroller's execution environment. Since many satellite flight software architectures operate with limited error recovery mechanisms for critical tasks, such an exception often causes the application task to crash or enter an unrecoverable state. This effectively halts the processing of subsequent commands and may require a system reset or reboot to restore functionality, thereby disrupting mission operations during a potentially critical period.
From a threat modeling perspective, this vulnerability aligns with CWE-125, which defines out-of-bounds read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. The attack vector is classified under ATT&CK technique T1046, Network Service Discovery, as it involves interacting directly with a network service interface to probe for weaknesses. In the context of space systems, the CAN bus often serves as the primary internal communication backbone between various subsystems and ground stations via telemetry downlinks or command uplinks if not properly segmented. The ability to inject crafted messages implies that an adversary who has gained access to this bus, whether through physical tampering with a deployed satellite's exposed ports or potentially through compromised ground station equipment sending malicious commands, can destabilize the flight software.
The operational impact of this vulnerability extends beyond simple service interruption. For CubeSats and similar small satellites, power management is often tightly coupled with task scheduling and system health monitoring. A crash in the command parsing module may prevent the execution of essential housekeeping routines or attitude control adjustments if those functions are dependent on the same application layer. Furthermore, repeated exploitation attempts could lead to increased wear on flash memory if the system repeatedly reboots to recover from crashes. This reduces the operational lifespan of the satellite and increases the risk of permanent failure in long-duration missions where remote recovery options may be limited or non-existent due to bandwidth constraints or safety protocols that prevent automatic resets during sensitive operations like orbital maneuvers.
Mitigation strategies must focus on rigorous input validation and defensive programming practices within the embedded software development lifecycle. The primary fix involves implementing strict bounds checking for all incoming CAN message payloads before they are processed by the parsePerformFunctionMessage function. Developers should verify that the length field of the received frame does not exceed the maximum buffer size allocated for parsing operations. Additionally, integrating static analysis tools and fuzzing techniques during the testing phase can help identify such boundary violations early in development. It is also advisable to implement watchdog timers with appropriate reset thresholds to ensure that if a crash occurs due to an unhandled exception, the system recovers gracefully without entering infinite loops or hanging states. Finally, securing the CAN bus through message authentication codes and encryption where feasible would prevent unauthorized actors from injecting these crafted messages in the first place, thereby addressing the root cause of the attack vector rather than just the symptom.