NASA CryptoLib up to 1.3.3 Crypto_TC_ApplySecurity integer underflow

Summaryinfo

A vulnerability labeled as very critical has been found in NASA CryptoLib up to 1.3.3. The impacted element is the function Crypto_TC_ApplySecurity. The manipulation results in integer underflow. This vulnerability was named CVE-2025-29909. The attack may be performed from remote. There is no available exploit. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as very critical has been found in NASA CryptoLib up to 1.3.3. Affected is the function Crypto_TC_ApplySecurity. The manipulation with an unknown input leads to a integer underflow vulnerability. CWE is classifying the issue as CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a heap buffer overflow vulnerability in CryptoLib's `Crypto_TC_ApplySecurity()` allows an attacker to craft a malicious TC frame that causes out-of-bounds memory writes. This can result in denial of service (DoS) or, under certain conditions, remote code execution (RCE). Any application or system that relies on CryptoLib for Telecommand (TC) processing and does not strictly validate incoming TC frames is at risk. This includes satellite ground stations or mission control software where attackers can inject malformed frames. A patch is available at commit c7e8a8745ff4b5e9bd7e500e91358e86d5abedcc.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-29909 since 03/12/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/18/2025).

Applying the patch c7e8a8745ff4b5e9bd7e500e91358e86d5abedcc is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• NASA

Name

• CryptoLib

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3

License

• open-source

Website

• Product: https://github.com/nasa/CryptoLib/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion