CVE-2025-29911

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_AOS_ProcessSecurity` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted AOS frame with an insufficient length. The vulnerability lies in the function `Crypto_AOS_ProcessSecurity`, specifically during the processing of the Frame Error Control Field (FECF). The affected code attempts to read from the `p_ingest` buffer at indices `current_managed_parameters_struct.max_frame_size - 2` and `current_managed_parameters_struct.max_frame_size - 1` without verifying if `len_ingest` is sufficiently large. This leads to a heap buffer overflow when `len_ingest` is smaller than `max_frame_size`. As of time of publication, no known patched versions exist.

• CWE-122
• CWE-787

• https://github.com/nasa/CryptoLib/security/advisories/GHSA-7g6g-9gj4-8c68Exploit, Vendor Advisory
• https://github.com/nasa/CryptoLib/security/advisories/GHSA-7g6g-9gj4-8c68Exploit, Vendor Advisory

Published

Mar 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29906Finit is a fast init for Linux systems. Versions starting fr…8.6
• CVE-2025-29907jsPDF is a library to generate PDFs in JavaScript. Prior to …7.5
• CVE-2025-29908Netty QUIC codec is a QUIC codec for netty which makes use o…5.3
• CVE-2025-29909CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-2991A vulnerability classified as critical has been found in Ten…6.9
• CVE-2025-29910CryptoLib provides a software-only solution using the CCSDS …7.5
• CVE-2025-29912CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-29913CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-29914OWASP Coraza WAF is a golang modsecurity compatible web appl…5.4
• CVE-2025-29915Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2025-29916Suricata is a network Intrusion Detection System, Intrusion …5.5
• CVE-2025-29917Suricata is a network Intrusion Detection System, Intrusion …5.5