Buffer overflow in Nasa Cryptolib
CVE-2025-54878
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A heap buffer overflow vulnerability exists in NASA CryptoLib version 1.4.0 and prior in the IV setup logic for telecommand frames. The problem arises from missing bounds checks when copying the Initialization Vector (IV) into a freshly allocated buffer. An attacker can supply a crafted TC frame that causes the library to write one byte past the end of the heap buffer, leading to heap corruption and undefined behaviour. An attacker supplying a malformed telecommand frame can corrupt heap memory. This leads to undefined behaviour, which could manifest itself as a crash (denial of service) or more severe exploitation. This issue has been patched in version 1.4.0.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.
EPSS exploit prediction
EPSS: 0.004 (30.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 30.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Nasa Cryptolib — versions < 1.4.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/nasa/CryptoLib/security/advisories/GHSA-9qph-pxfm-q9g4 (Exploit, Third Party Advisory)
- github.com/nasa/CryptoLib/commit/9b5b294ec09da450d2d4d05aea2db604ead48be1 (Patch)
Frequently asked questions
- What is CVE-2025-54878?
- CVE-2025-54878 is a high-severity vulnerability in Nasa Cryptolib, classified under Heap-based Buffer Overflow. CVSS score: 8.6/10. Published 2025-08-11.
- How severe is CVE-2025-54878?
- High severity. CVSS v3 base score is 8.6 out of 10.
- Is CVE-2025-54878 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.