CVE-2026-21899 is an out-of-bounds (OOB) read vulnerability classified under CWE-125 found in NASA's CryptoLib, a software-only implementation of the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP). This library is used to secure communications between spacecraft running the core Flight System (cFS) and ground stations. The vulnerability exists in the base64urlDecode function where the code attempts to strip padding by dereferencing input[inputLen - 1] before verifying that inputLen is greater than zero and that the input pointer is not NULL. If inputLen is zero, this results in an OOB read at input[-1], potentially causing a crash or undefined behavior. Worse, if input is NULL and inputLen is zero, the code dereferences a NULL pointer offset by -1, leading to a null pointer dereference. These conditions can cause denial of service through process crashes and may expose memory contents, impacting confidentiality and integrity. The vulnerability requires network access (AV:N), low attack complexity (AC:L), and high privileges (PR:H), with no user interaction (UI:N). The scope is unchanged (S:U), and the CVSS v3.1 base score is 4.7, indicating medium severity. The issue was patched in CryptoLib version 1.4.3. No known exploits have been reported in the wild to date.

For European organizations, especially those involved in aerospace, satellite communications, or space research, this vulnerability could disrupt secure communications between spacecraft and ground stations, potentially leading to denial of service or leakage of sensitive mission data. The out-of-bounds read could cause system crashes, impacting availability of critical communication links. Confidentiality and integrity risks arise if memory contents are exposed or corrupted. Given the specialized use of CryptoLib in space systems, the impact is significant for entities relying on this software for mission-critical operations. Disruptions could affect satellite control, data acquisition, and command execution, with downstream effects on scientific research, telecommunications, and defense. Although exploitation requires high privileges, insider threats or compromised ground station systems could leverage this flaw. The absence of known exploits reduces immediate risk but does not eliminate the threat, especially as attackers may develop exploits over time.

The primary mitigation is to upgrade all instances of NASA's CryptoLib to version 1.4.3 or later, where the vulnerability has been patched. Organizations should audit their software supply chain and embedded systems to identify CryptoLib usage, including indirect dependencies within aerospace and satellite communication software stacks. Implement rigorous input validation and boundary checks in any custom code interfacing with CryptoLib functions to prevent malformed inputs. Employ runtime protections such as memory safety tools and address sanitizers during development and testing to detect similar issues. Restrict access to ground station systems and spacecraft communication interfaces to trusted, authenticated personnel to reduce the risk of exploitation requiring high privileges. Monitor system logs for crashes or anomalies that could indicate attempted exploitation. Establish incident response plans tailored to aerospace communication disruptions. Finally, collaborate with vendors and space agencies to stay informed on updates and advisories related to CryptoLib and related protocols.