CryptoLib uses the CCSDS Space Data Link Security Protocol to protect ground‑station communications. Prior to version 1.4.3 the libcurl write_callback in the KMC crypto service client can reallocate response buffers without any bounds checking, allowing a malicious KMC server to send arbitrarily large HTTP responses. This causes the client process to allocate more memory than the system can provide, eventually exhausting resources and terminating the process, which results in a denial of service for the affected component.

The vulnerability affects NASA’s CryptoLib software for all releases before 1.4.3. Systems that run the Core Flight System on a spacecraft and communicate with a ground‑station using CryptoLib are impacted, regardless of the specific operating environment, as long as the vulnerable version is in use.

The flaw carries a CVSS score of 8.2, indicating high severity. Exploitation probability is very low according to the EPSS (<1%) and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a malicious or compromised KMC server that can control the content of the HTTP response sent to the CryptoLib client. Successful exploitation requires network access to the KMC service; no local privilege escalation or code execution is involved, but an attacker can trigger a service crash and interrupt secure communications.