CVE-2026-21898: CryptoLib Has Out-of-bounds Read in Crypto_AOS_ProcessSecurity
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the CryptoAOSProcessSecurity function reads memory without valid bounds checking when parsing AOS frame hashes. This issue has been patched in version 1.4.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21898?
The severity of CVE-2026-21898 is critical due to potential unauthorized access to sensitive communications.
How do I fix CVE-2026-21898?
To fix CVE-2026-21898, upgrade to CryptoLib version 1.4.3 or later.
What systems are affected by CVE-2026-21898?
CVE-2026-21898 affects CryptoLib versions prior to 1.4.3 used in securing communications for spacecraft.
What type of threat does CVE-2026-21898 represent?
CVE-2026-21898 represents a threat of data breaches and integrity compromise in space communication systems.
Has CVE-2026-21898 been publicly disclosed?
Yes, CVE-2026-21898 has been publicly disclosed and the details are available in security advisories.