CVE-2025-64096

Katalog CVE

CVSS 8.8 · High EPSS 0,52%

Kerentanan Stack-based Buffer Overflow pada nasa cryptolib. Skor CVSS 3.0 8.8 (High) menurut github.com.

Deskripsi (NVD)

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to 1.4.2, there is a missing bounds check in Crypto_Key_update() (crypto_key_mgmt.c) which allows a remote attacker to trigger a stack-based buffer overflow by supplying a TLV packet with a spoofed length field. The function calculates the number of keys from an attacker-controlled field (pdu_len), which may exceed the static array size (kblk[98]), leading to an out-of-bounds write and potential memory corruption. This vulnerability is fixed in 1.4.2.

Rincian

Terbit di NVD

30 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.0

8.8 (High), sumber github.com
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nasa/CryptoLib/security/advisories/GHSA-w6c3-pxvr-6m6j exploit · advisory vendor