NASA CryptoLib up to 1.4.2 Link Security Protocol len_data_out heap-based overflow

Summaryinfo

A vulnerability was found in NASA CryptoLib up to 1.4.2 and classified as critical. This affects an unknown part of the component Link Security Protocol. The manipulation of the argument len_data_out results in heap-based overflow. This vulnerability is identified as CVE-2026-22697. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in NASA CryptoLib up to 1.4.2. It has been classified as critical. Affected is an unknown code of the component Link Security Protocol. The manipulation of the argument len_data_out with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, CryptoLib’s KMC crypto service integration is vulnerable to a heap buffer overflow when decoding Base64-encoded ciphertext/cleartext fields returned by the KMC service. The decode destination buffer is sized using an expected output length (len_data_out), but the Base64 decoder writes output based on the actual Base64 input length and does not enforce any destination size limit. An oversized Base64 string in the KMC JSON response can cause out-of-bounds writes on the heap, resulting in process crash and potentially code execution under certain conditions. This issue has been patched in version 1.4.3.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-22697 since 01/08/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 1.4.3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-1888). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• NASA

Name

• CryptoLib

Version

• 1.4.0
• 1.4.1
• 1.4.2

Website

• Product: https://github.com/nasa/CryptoLib/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion