CVE-2025-64096

    Dashboard / Vulnerabilities / CVE-2025-64096

    CVE-2025-64096

    Published: 30 Oct 2025Last Modified: 12 Aug 2026

    Summary: CryptoLib vulnerable to Stack Buffer Overflow in Crypto_Key_Update due to missing TLV length check

    Details: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to 1.4.2, there is a missing bounds check in Crypto_Key_update() (crypto_key_mgmt.c) which allows a remote attacker to trigger a stack-based buffer overflow by supplying a TLV packet with a spoofed length field. The function calculates the number of keys from an attacker-controlled field (pdu_len), which may exceed the static array size (kblk[98]), leading to an out-of-bounds write and potential memory corruption. This vulnerability is fixed in 1.4.2.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64096.json, https://github.com/nasa/CryptoLib/security/advisories/GHSA-w6c3-pxvr-6m6j, https://nvd.nist.gov/vuln/detail/CVE-2025-64096

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -309c1c4a57313044215ca730abfa3fbe9e5feed0

    Affected versions

    v1.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2025-64096 | CVE-DB