The vulnerability is a heap buffer overflow triggered when CryptoLib decodes Base64 strings from KMC service JSON responses. The decoder allocates a destination buffer based on an expected output length, yet writes output according to the actual Base64 length without bound checks. An attacker can supply an oversized Base64 string, causing out‑of‑bounds writes on the heap. This can lead to a process crash and, under certain conditions, arbitrary code execution, compromising the confidentiality, integrity, or availability of the target system.

NASA’s CryptoLib software library is affected. Version 1.4.3 contains the patch, but any releases prior to 1.4.3 remain vulnerable. The weakness is catalogued as CWE‑122, indicating an unchecked buffer overflow in heap memory allocation.

The CVSS base score of 7.5 signals high severity. However, the EPSS probability is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation in the wild. The likely attack vector is inferred from the description, as the attacker must manipulate the KMC service response to deliver a maliciously large Base64 string, likely through remote API manipulation or compromised communication channels. While the flaw can crash the application, achieving code execution requires additional conditions that are not guaranteed.