CryptoLib’s base64urlDecode function performs a padding‑stripping operation that dereferences input[inputLen - 1] before verifying that the input pointer is non‑null and that the length is greater than zero. When an empty Base64url string (length zero) or a NULL pointer with zero length is supplied, the function reads outside the bounds of the input array or dereferences a NULL pointer, causing the library to crash. The vulnerability is classified as an out‑of‑bounds read that leads to a denial of service through process termination. No remote code execution or data disclosure is directly possible from the information supplied.

The issue exists in versions of NASA’s CryptoLib prior to 1.4.3. All installations running CryptoLib 1.4.2 or earlier are susceptible. The fix is applied in release 1.4.3.

With a CVSS score of 4.7, the vulnerability is moderate. The EPSS score is less than 1%, indicating a very low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploits. Attackers would need to provide an empty or NULL Base64url string to the base64urlDecode routine, which may be achievable if the library is exposed to untrusted input such as telemetry, command, or configuration streams. Proper validation or the official patch removes the possibility of a crash.