The vulnerability is a heap buffer overflow in CryptoLib's MariaDB SA interface. The convert_hexstring_to_byte_array function writes decoded bytes into a caller‑supplied buffer without bounds checking. When importing security association fields from the database, a malformed or oversized hex string can overflow the buffer, corrupting adjacent heap memory. This can lead to data corruption, denial of service, or other unintended behavior. The weakness is a classic buffer overflow (CWE‑122).

NASA’s CryptoLib software, used in spacecraft and ground station communications, is affected. Versions up to and including 1.4.2 contain the flaw; the issue was fixed in release 1.4.3. The vulnerability resides in the MariaDB SA interface used by CryptoLib’s security functions.

The CVSS score is 5.7, indicating moderate impact. The EPSS score is below 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to write a crafted hex string into the database and then trigger the import routine, meaning the threat comes from an insider or a user with database write privileges rather than from an external network attacker. Overall risk is moderate, but the potential impact of memory corruption warrants patching as soon as possible.