An out-of-bounds read occurs in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software. When a crafted CAN message is received, the parser reads memory beyond the intended bounds, causing the onboard computer to crash or become unresponsive. This failure leads directly to a denial of service, disrupting spacecraft operations.

SpaceDot AcubeSAT On–Board Computer firmware, specifically the version identified by commit eaf90ec. The vendor is not publicly listed, and the product is an embedded OBC that communicates over a CAN bus with other spacecraft subsystems.

The CVSS score of 7.1 indicates a moderate‑to‑high severity for availability. The EPSS score is below 1% and the flaw is not listed in the CISA KEV catalog, implying a low probability of widespread exploitation. However, an attacker with physical or network access to the CAN bus could reliably trigger the overread by injecting malformed frames, leading to a crash and loss of mission‑critical functions.