CryptoLib implements the CCSDS Space Data Link Security Protocol – Extended Procedures for secure spacecraft communications. In versions prior to 1.4.3, the cryptography_aead_encrypt() function contains an out‑of‑bounds heap read, triggered when parsing encryption metadata using a flawed strtok pattern. This flaw allows a malicious user to cause the library to read beyond the bounds of the intended buffer and disclose sensitive memory contents such as cryptographic keys or other private data, as identified by CWE‑125.

NASA’s CryptoLib is the affected vendor and product. Any installation using CryptoLib before release 1.4.3 is vulnerable; version 1.4.3 and later contain the patch.

The CVSS score of 8.2 indicates a high impact vulnerability, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, reducing its perceived threat level for critical missions. Although the attack vector is not explicitly documented, the flaw is exercised during AEAD encryption, implying that an attacker would need to supply crafted metadata input, which could be feasible in a compromised or untrusted environment. The official remediation is to update to version 1.4.3, which eliminates the out‑of‑bounds read.