CVE-2025-29913— CryptoLib's Crypto_TC_Prep_AAD Has Buffer Overflow Due to Integer Underflow
Quick assessment
Affected
nasa CryptoLib
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CryptoLib是NASA开源的一个应用程序。用于使用 CCSDS 空间数据链路安全协议提供纯软件解决方案。 CryptoLib 1.3.3及之前版本存在数字错误漏洞，该漏洞源于Crypto_TC_Prep_AAD函数存在无符号整数下溢，可能导致堆缓冲区溢出，从而引发拒绝服务或执行任意代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-29913
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CryptoLib's Crypto_TC_Prep_AAD Has Buffer Overflow Due to Integer Underflow
Source: CVE Program / CVE List V5
Vulnerability Description
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_TC_Prep_AAD` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted telecommand (TC) frame that causes an unsigned integer underflow. The vulnerability lies in the function `Crypto_TC_Prep_AAD`, specifically during the computation of `tc_mac_start_index`. The affected code incorrectly calculates the MAC start index without ensuring it remains within the bounds of the `ingest` buffer. When `tc_mac_start_index` underflows due to an incorrect length calculation, the function attempts to access an out-of-bounds memory location, leading to a segmentation fault. The vulnerability is still present in the repository as of commit `d3cc420ace96d02a5b7e83d88cbd2e48010d5723`.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
CryptoLib 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CryptoLib是NASA开源的一个应用程序。用于使用 CCSDS 空间数据链路安全协议提供纯软件解决方案。 CryptoLib 1.3.3及之前版本存在数字错误漏洞，该漏洞源于Crypto_TC_Prep_AAD函数存在无符号整数下溢，可能导致堆缓冲区溢出，从而引发拒绝服务或执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-29913
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-29913
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-29913 (1)
Same Patch Batch · nasa · 2025-03-17 · 5 CVEs total
| CVE-2025-29909 | CryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow Vulnerability | |
| CVE-2025-29910 | CryptoLib's crypto_handle_incrementing_nontransmitted_counter Function has Memory Leak | |
| CVE-2025-29911 | CryptoLib Has Heap Buffer Overflow in Crypto_AOS_ProcessSecurity Function | |
| CVE-2025-29912 | CryptoLib Has Heap Buffer Overflow Due to Unsigned Integer Underflow in Crypto_TC_ProcessS |
IV. Related Vulnerabilities
Same product: CryptoLib
-
CVE-2026-79954
NASA CryptoLib 1.5.0 - TC receive path accepts Security Asso -
CVE-2026-22697
CryptoLib Has Heap Buffer Overflow Vulnerability in KMC Base -
CVE-2026-22027
CryptoLib Vulnerable to Heap Buffer Overflow in MariaDB SA H -
CVE-2026-22026
CryptoLib Unbounded Memory Allocation in KMC HTTP Response H -
CVE-2026-22025
CryptoLib Memory Leak on HTTP Error Response in KMC Client
Same vendor: nasa
-
CVE-2026-92160
F´: SendPartial Integer Overflow Leading to Assertion DoS -
CVE-2026-92155
F´: FileUplink Unknown Packet Type Assertion DoS -
CVE-2026-92150
F´: GenericHub Malformed Buffer Assertion DoS -
CVE-2026-92154
F´: File size bounds bypass in Svc::FileUplink via unsigned -
CVE-2026-92158
F´: FpySequencer Integer Overflow in Stack Offset/Size Valid
Same weakness: CWE-125
-
CVE-2026-111677
Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstIn -
CVE-2026-111678
Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c F -
CVE-2026-49868
RIOT: DHCPv6 client _parse_reply() missing sub-option length -
CVE-2026-68906
libIEC61850: Infinite loop and out-of-bounds read in ACSE pa -
CVE-2026-68907
libIEC61850: Server-side out-of-bounds stack read in associa
V. Comments for CVE-2025-29913
No comments yet