CryptoLib implements a software‑only protection for spacecraft‑ground communication. The vulnerability exists in the Crypto_Config_Add_Gvcid_Managed_Parameters routine which incorrectly allows the gvcid_counter to exceed the array bounds. As a result an out‑of‑bounds write overwrites the counter immediately after the GVCID parameter array. This can corrupt state used for future parameter lookups, potentially permitting an attacker to corrupt configuration data or cause a failure in the registration logic. The weakness is a classic buffer overrun (CWE‑787).

The affected product is NASA's CryptoLib and applies to all releases earlier than version 1.4.3. Any system that incorporates CryptoLib for the CCSDS Space Data Link Security Protocol – Extended Procedures (SDLS‑EP) is impacted until the code is updated to v1.4.3 or later.

The CVSS score is 7.3, indicating a moderate‑to‑high risk. EPSS is below 1 %, suggesting low exploitation probability at present, and the vulnerability is not in the CISA KEV list. The attack vector is not explicitly disclosed; the flaw is within a core function and would be triggered by supplying a gvcid_counter larger than the defined limit, likely through a local or privileged execution path. No remote exploit chain is documented, but the memory corruption could lead to denial of service or manipulation of spacecraft‑ground communication parameters if executed with sufficient privileges.