CVE-2026-21897

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21897", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T17:24:36.930Z", "datePublished": "2026-01-10T00:07:16.920Z", "dateUpdated": "2026-01-12T20:21:22.735Z"}, "containers": {"cna": {"title": "CryptoLib Has Out-of-Bounds Write in Crypto_Config_Add_Gvcid_Managed_Parameters", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-9x7j-gx23-7m5r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-9x7j-gx23-7m5r"}, {"name": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3"}], "affected": [{"vendor": "nasa", "product": "CryptoLib", "versions": [{"version": "< 1.4.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T00:07:16.920Z"}, "descriptions": [{"lang": "en", "value": "CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_Config_Add_Gvcid_Managed_Parameters function only checks whether gvcid_counter > GVCID_MAN_PARAM_SIZE. As a result, it allows up to the 251st entry, which causes a write past the end of the array, overwriting gvcid_counter located immediately after gvcid_managed_parameters_array[250]. This leads to an out-of-bounds write, and the overwritten gvcid_counter may become an arbitrary value, potentially affecting the parameter lookup/registration logic that relies on it. This issue has been patched in version 1.4.3."}], "source": {"advisory": "GHSA-9x7j-gx23-7m5r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T20:21:14.781089Z", "id": "CVE-2026-21897", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T20:21:22.735Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21897", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T20:21:14.781089Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T20:21:19.132Z"}}], "cna": {"title": "CryptoLib Has Out-of-Bounds Write in Crypto_Config_Add_Gvcid_Managed_Parameters", "source": {"advisory": "GHSA-9x7j-gx23-7m5r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nasa", "product": "CryptoLib", "versions": [{"status": "affected", "version": "< 1.4.3"}]}], "references": [{"url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-9x7j-gx23-7m5r", "name": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-9x7j-gx23-7m5r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3", "name": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_Config_Add_Gvcid_Managed_Parameters function only checks whether gvcid_counter > GVCID_MAN_PARAM_SIZE. As a result, it allows up to the 251st entry, which causes a write past the end of the array, overwriting gvcid_counter located immediately after gvcid_managed_parameters_array[250]. This leads to an out-of-bounds write, and the overwritten gvcid_counter may become an arbitrary value, potentially affecting the parameter lookup/registration logic that relies on it. This issue has been patched in version 1.4.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T00:07:16.920Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21897", "state": "PUBLISHED", "dateUpdated": "2026-01-12T20:21:22.735Z", "dateReserved": "2026-01-05T17:24:36.930Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T00:07:16.920Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CryptoLib", "vendor": "nasa", "versions": [{"status": "affected", "version": "< 1.4.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nasa:cryptolib:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE1BE91E-2901-42AF-BC66-762CFA7A2582", "versionEndExcluding": "1.4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_Config_Add_Gvcid_Managed_Parameters function only checks whether gvcid_counter > GVCID_MAN_PARAM_SIZE. As a result, it allows up to the 251st entry, which causes a write past the end of the array, overwriting gvcid_counter located immediately after gvcid_managed_parameters_array[250]. This leads to an out-of-bounds write, and the overwritten gvcid_counter may become an arbitrary value, potentially affecting the parameter lookup/registration logic that relies on it. This issue has been patched in version 1.4.3."}, {"lang": "es", "value": "CryptoLib proporciona una soluci\u00f3n \u00fanicamente de software utilizando el Protocolo de Seguridad de Enlace de Datos Espaciales CCSDS - Procedimientos Extendidos (SDLS-EP) para asegurar las comunicaciones entre una nave espacial ejecutando el Sistema de Vuelo central (cFS) y una estaci\u00f3n terrestre. Antes de la versi\u00f3n 1.4.3, la funci\u00f3n Crypto_Config_Add_Gvcid_Managed_Parameters solo verifica si gvcid_counter &gt; GVCID_MAN_PARAM_SIZE. Como resultado, permite hasta la entrada 251, lo que provoca una escritura m\u00e1s all\u00e1 del final del array, sobrescribiendo gvcid_counter ubicado inmediatamente despu\u00e9s de gvcid_managed_parameters_array[250]. Esto conduce a una escritura fuera de l\u00edmites, y el gvcid_counter sobrescrito puede convertirse en un valor arbitrario, afectando potencialmente la l\u00f3gica de b\u00fasqueda/registro de par\u00e1metros que depende de \u00e9l. Este problema ha sido parcheado en la versi\u00f3n 1.4.3."}], "id": "CVE-2026-21897", "lastModified": "2026-06-17T10:19:06.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21897", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T20:21:14.781089Z", "version": "2.0.3"}}]}, "published": "2026-01-10T01:16:17.053", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-9x7j-gx23-7m5r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:21:55.877489+00:00", "value": {"mitigation_remediation": ["Upgrade CryptoLib to version\u202f1.4.3 or later as released by NASA.", "If an upgrade cannot be performed immediately, modify the client code to check that gvcid_counter does not exceed GVCID_MAN_PARAM_SIZE before calling Crypto_Config_Add_Gvcid_Managed_Parameters.", "Continuously monitor system logs for anomalies related to parameter registration and restrict unauthorized writes to the configuration module."], "summary": {"action": "Immediate Patch", "impact": "Memory Corruption"}, "threat_synthesis": {"affected_systems": "The affected product is NASA's CryptoLib and applies to all releases earlier than version\u202f1.4.3. Any system that incorporates CryptoLib for the CCSDS Space Data Link Security Protocol \u2013 Extended Procedures (SDLS\u2011EP) is impacted until the code is updated to v1.4.3 or later.", "description_and_impact": "CryptoLib implements a software\u2011only protection for spacecraft\u2011ground communication. The vulnerability exists in the Crypto_Config_Add_Gvcid_Managed_Parameters routine which incorrectly allows the gvcid_counter to exceed the array bounds. As a result an out\u2011of\u2011bounds write overwrites the counter immediately after the GVCID parameter array. This can corrupt state used for future parameter lookups, potentially permitting an attacker to corrupt configuration data or cause a failure in the registration logic. The weakness is a classic buffer overrun (CWE\u2011787).", "risk_and_exploitability": "The CVSS score is 7.3, indicating a moderate\u2011to\u2011high risk. EPSS is below 1\u202f%, suggesting low exploitation probability at present, and the vulnerability is not in the CISA KEV list. The attack vector is not explicitly disclosed; the flaw is within a core function and would be triggered by supplying a gvcid_counter larger than the defined limit, likely through a local or privileged execution path. No remote exploit chain is documented, but the memory corruption could lead to denial of service or manipulation of spacecraft\u2011ground communication parameters if executed with sufficient privileges."}}}}, "created": "2026-01-12T14:36:38.677846+00:00", "updated": "2026-04-18T07:30:36.026292+00:00", "vendors": ["nasa", "nasa$PRODUCT$cryptolib"]}