CVE-2026-21900
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-125
Lectura fuera de límites
Fecha de publicación:
10/01/2026
Última modificación:
10/01/2026
Descripción
*** Pendiente de traducción *** CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, an out-of-bounds heap read vulnerability in cryptography_encrypt() occurs when parsing JSON metadata from KMC server responses. The flawed strtok iteration pattern uses ptr + strlen(ptr) + 1 which reads one byte past allocated buffer boundaries when processing short or malformed metadata strings. This issue has been patched in version 1.4.3.
Impacto
Puntuación base 4.0
8.20
Gravedad 4.0
ALTA