CVE-2026-22697

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22697", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-08T19:23:09.856Z", "datePublished": "2026-01-10T00:31:11.045Z", "dateUpdated": "2026-01-13T21:48:38.005Z"}, "containers": {"cna": {"title": "CryptoLib Has Heap Buffer Overflow Vulnerability in KMC Base64 Decode Handling (KMC JSON base64ciphertext/base64cleartext)", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4"}, {"name": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3"}], "affected": [{"vendor": "nasa", "product": "CryptoLib", "versions": [{"version": "< 1.4.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T00:31:11.045Z"}, "descriptions": [{"lang": "en", "value": "CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, CryptoLib\u2019s KMC crypto service integration is vulnerable to a heap buffer overflow when decoding Base64-encoded ciphertext/cleartext fields returned by the KMC service. The decode destination buffer is sized using an expected output length (len_data_out), but the Base64 decoder writes output based on the actual Base64 input length and does not enforce any destination size limit. An oversized Base64 string in the KMC JSON response can cause out-of-bounds writes on the heap, resulting in process crash and potentially code execution under certain conditions. This issue has been patched in version 1.4.3."}], "source": {"advisory": "GHSA-qjx3-83jh-2jc4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T21:48:35.288004Z", "id": "CVE-2026-22697", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T21:48:38.005Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22697", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T21:48:35.288004Z"}}}], "references": [{"url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T21:48:25.655Z"}}], "cna": {"title": "CryptoLib Has Heap Buffer Overflow Vulnerability in KMC Base64 Decode Handling (KMC JSON base64ciphertext/base64cleartext)", "source": {"advisory": "GHSA-qjx3-83jh-2jc4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nasa", "product": "CryptoLib", "versions": [{"status": "affected", "version": "< 1.4.3"}]}], "references": [{"url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4", "name": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3", "name": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, CryptoLib\u2019s KMC crypto service integration is vulnerable to a heap buffer overflow when decoding Base64-encoded ciphertext/cleartext fields returned by the KMC service. The decode destination buffer is sized using an expected output length (len_data_out), but the Base64 decoder writes output based on the actual Base64 input length and does not enforce any destination size limit. An oversized Base64 string in the KMC JSON response can cause out-of-bounds writes on the heap, resulting in process crash and potentially code execution under certain conditions. This issue has been patched in version 1.4.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T00:31:11.045Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22697", "state": "PUBLISHED", "dateUpdated": "2026-01-13T21:48:38.005Z", "dateReserved": "2026-01-08T19:23:09.856Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T00:31:11.045Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CryptoLib", "vendor": "nasa", "versions": [{"status": "affected", "version": "< 1.4.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nasa:cryptolib:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE1BE91E-2901-42AF-BC66-762CFA7A2582", "versionEndExcluding": "1.4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, CryptoLib\u2019s KMC crypto service integration is vulnerable to a heap buffer overflow when decoding Base64-encoded ciphertext/cleartext fields returned by the KMC service. The decode destination buffer is sized using an expected output length (len_data_out), but the Base64 decoder writes output based on the actual Base64 input length and does not enforce any destination size limit. An oversized Base64 string in the KMC JSON response can cause out-of-bounds writes on the heap, resulting in process crash and potentially code execution under certain conditions. This issue has been patched in version 1.4.3."}, {"lang": "es", "value": "CryptoLib proporciona una soluci\u00f3n \u00fanicamente de software utilizando el Protocolo de Seguridad de Enlace de Datos Espaciales CCSDS - Procedimientos Extendidos (SDLS-EP) para asegurar las comunicaciones entre una nave espacial que ejecuta el Sistema de Vuelo central (cFS) y una estaci\u00f3n terrestre. Antes de la versi\u00f3n 1.4.3, la integraci\u00f3n del servicio criptogr\u00e1fico KMC de CryptoLib es vulnerable a un desbordamiento de b\u00fafer de pila al decodificar campos de texto cifrado/texto claro codificados en Base64 devueltos por el servicio KMC. El b\u00fafer de destino de decodificaci\u00f3n se dimensiona utilizando una longitud de salida esperada (len_data_out), pero el decodificador Base64 escribe la salida bas\u00e1ndose en la longitud real de la entrada Base64 y no impone ning\u00fan l\u00edmite de tama\u00f1o de destino. Una cadena Base64 sobredimensionada en la respuesta JSON del KMC puede causar escrituras fuera de l\u00edmites en la pila, lo que resulta en un fallo del proceso y potencialmente la ejecuci\u00f3n de c\u00f3digo bajo ciertas condiciones. Este problema ha sido parcheado en la versi\u00f3n 1.4.3."}], "id": "CVE-2026-22697", "lastModified": "2026-06-17T10:20:15.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22697", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T21:48:35.288004Z", "version": "2.0.3"}}]}, "published": "2026-01-10T01:16:19.160", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:34:20.388002+00:00", "value": {"mitigation_remediation": ["Upgrade CryptoLib to version 1.4.3 to apply the fixed Base64 decoder.", "Add a pre\u2011decode check that validates the Base64 string length against the expected output size and rejects or truncates any input that exceeds the limit.", "Monitor KMC service responses for abnormal Base64 field sizes and investigate or block any unexpected payloads to reduce the attack surface."], "summary": {"action": "Patch immediately", "impact": "Potential Arbitrary Code Execution"}, "threat_synthesis": {"affected_systems": "NASA\u2019s CryptoLib software library is affected. Version 1.4.3 contains the patch, but any releases prior to 1.4.3 remain vulnerable. The weakness is catalogued as CWE\u2011122, indicating an unchecked buffer overflow in heap memory allocation.", "description_and_impact": "The vulnerability is a heap buffer overflow triggered when CryptoLib decodes Base64 strings from KMC service JSON responses. The decoder allocates a destination buffer based on an expected output length, yet writes output according to the actual Base64 length without bound checks. An attacker can supply an oversized Base64 string, causing out\u2011of\u2011bounds writes on the heap. This can lead to a process crash and, under certain conditions, arbitrary code execution, compromising the confidentiality, integrity, or availability of the target system.", "risk_and_exploitability": "The CVSS base score of 7.5 signals high severity. However, the EPSS probability is below 1\u202f%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation in the wild. The likely attack vector is inferred from the description, as the attacker must manipulate the KMC service response to deliver a maliciously large Base64 string, likely through remote API manipulation or compromised communication channels. While the flaw can crash the application, achieving code execution requires additional conditions that are not guaranteed."}}}}, "created": "2026-01-12T14:36:45.220815+00:00", "updated": "2026-04-18T16:45:05.218907+00:00", "vendors": ["nasa", "nasa$PRODUCT$cryptolib"]}