CVE-2026-22023
Published: 10 January 2026
Summary
CVE-2026-22023 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Nasa Cryptolib. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 40.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-22023 is an out-of-bounds heap read vulnerability (CWE-125) in the cryptography_aead_encrypt() function within NASA's CryptoLib. CryptoLib is a software-only library that implements the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between spacecraft running the core Flight System (cFS) and ground stations. The flaw affects versions of CryptoLib prior to 1.4.3 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no authentication privileges or user interaction. Exploitation triggers an out-of-bounds heap read, resulting in high-impact availability disruption—such as denial-of-service through application crashes—while confidentiality and integrity remain unaffected.
NASA patched the vulnerability in CryptoLib version 1.4.3, as detailed in the project's GitHub release, the fixing commit (2372efd3da1ccb226b4297222e25f41ecc84821d), and the associated security advisory (GHSA-8w3h-q8jm-3chq). Security practitioners should update to version 1.4.3 or later to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1893
Vulnerability details
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, there is an…
more
out-of-bounds heap read vulnerability in cryptography_aead_encrypt(). This issue has been patched in version 1.4.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB heap read in network-exposed CryptoLib directly enables remote application crash for DoS via software exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and correction of flaws like the out-of-bounds heap read in CryptoLib's cryptography_aead_encrypt() by applying the patch in version 1.4.3.
Enables detection of the vulnerable CryptoLib version prior to version 1.4.3 through regular vulnerability scanning and monitoring.
Implements memory safeguards such as address space layout randomization that mitigate exploitation of heap-based out-of-bounds reads leading to denial-of-service.