CVE-2026-21897 is an out-of-bounds write vulnerability classified under CWE-787 found in NASA's CryptoLib, a software-only implementation of the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP). This library secures communications between spacecraft running the core Flight System (cFS) and ground stations. The vulnerability arises in the Crypto_Config_Add_Gvcid_Managed_Parameters function, which manages an array of GVCID (Global Virtual Channel Identifier) managed parameters. The function only checks if gvcid_counter is greater than GVCID_MAN_PARAM_SIZE before allowing an addition, permitting up to the 251st entry in an array sized for 250 entries (index 0 to 249). This off-by-one error leads to a write beyond the array boundary, overwriting the gvcid_counter variable located immediately after the array. Corruption of gvcid_counter can cause it to hold arbitrary values, potentially disrupting the parameter lookup and registration logic that depends on it. Such corruption can lead to unpredictable behavior, including denial of service or incorrect cryptographic operations, affecting confidentiality, integrity, and availability of communications. The vulnerability is remotely exploitable without requiring privileges or user interaction, increasing its risk. The issue was patched in CryptoLib version 1.4.3 by correcting the boundary check to prevent out-of-bounds writes. No known exploits have been reported in the wild as of the publication date. The CVSS v3.1 score is 7.3 (high), reflecting the network attack vector, low attack complexity, no privileges required, and no user interaction needed, with impacts on confidentiality, integrity, and availability.

For European organizations, especially those involved in aerospace, satellite communications, and space research, this vulnerability poses a significant risk. Compromise of the CryptoLib could lead to unauthorized manipulation or disruption of spacecraft-to-ground communications, potentially causing mission failures, data corruption, or loss of sensitive telemetry and command data. The integrity and availability of critical space communication links could be undermined, affecting satellite operations and related infrastructure. Given the reliance on secure communication protocols in space missions, exploitation could also have cascading effects on dependent systems and services. Although no active exploits are known, the vulnerability's remote exploitability and high severity necessitate prompt attention. Organizations operating or collaborating with space agencies or contractors using the affected CryptoLib versions must consider the risk to their operational continuity and data security.

The primary mitigation is to upgrade CryptoLib to version 1.4.3 or later, where the boundary check flaw has been corrected. Organizations should audit their software supply chain and embedded systems to identify any use of vulnerable CryptoLib versions. Implement rigorous input validation and boundary checking in custom or dependent code handling GVCID parameters. Conduct thorough testing of cryptographic modules for similar out-of-bounds vulnerabilities. Employ runtime protections such as memory safety tools or address sanitizers during development and testing phases. For deployed systems where immediate upgrade is not feasible, consider isolating affected components from network exposure and monitoring for anomalous behavior indicative of exploitation attempts. Engage with vendors and partners to ensure timely patch deployment and share threat intelligence related to this vulnerability. Finally, incorporate this vulnerability into risk assessments and incident response plans specific to aerospace and satellite communication environments.