CVE-2025-46672 Details

A vulnerability in NASA CryptoLib versions prior to 1.3.2 allows for spacecraft hijacking by exploiting the OTAR crypto function's status check. The issue arises from an out-of-bounds read vulnerability that bypasses the Space Data Link Security (SDLS) protocol, enabling unauthorized commands to be sent to a spacecraft's Onboard Computer (OBC). This vulnerability takes advantage of improper management of Security Associations (SAs) and cryptographic keys, potentially leading to unauthorized control of the spacecraft.

Users are advised to update to NASA CryptoLib version 1.3.2 or later, where this vulnerability has been addressed.