CVE-2026-22027

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the convert_hexstring_to_byte_array() function in the MariaDB SA interface writes decoded bytes into a caller-provided buffer without any capacity check. When importing SA fields from the database (e.g., IV, ARSN, ABM), a malformed or oversized hex string in the database can overflow the destination buffer, corrupting adjacent heap memory. This issue has been patched in version 1.4.3.

• CWE-122

• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821dPatch
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3Release Notes
• https://github.com/nasa/CryptoLib/security/advisories/GHSA-3m35-m689-h29xExploit, Vendor Advisory
• https://github.com/nasa/CryptoLib/security/advisories/GHSA-3m35-m689-h29xExploit, Vendor Advisory

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22021Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,…5.3
• CVE-2026-22022Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on…8.2
• CVE-2026-22023CryptoLib provides a software-only solution using the CCSDS …7.5
• CVE-2026-22024CryptoLib provides a software-only solution using the CCSDS …5.3
• CVE-2026-22025CryptoLib provides a software-only solution using the CCSDS …3.7
• CVE-2026-22026CryptoLib provides a software-only solution using the CCSDS …7.5
• CVE-2026-22028Preact, a lightweight web development framework, JSON serial…6.1
• CVE-2026-22029React Router is a router for React. In @remix-run/router ver…6.1
• CVE-2026-2203A flaw has been found in Tenda AC8 16.03.33.05. Affected by …8.8
• CVE-2026-22030React Router is a router for React. In @remix-run/server-run…6.5
• CVE-2026-22031@fastify/middie is the plugin that adds middleware support o…8.8
• CVE-2026-22032Directus is a real-time API and App dashboard for managing S…6.1