High severity · published Sep 18, 2026
CVE-2026-79954
NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID
8.7
CVSS
0.6%
EPSS
No
On KEV
Description
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
CryptoLib · NASA
1.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-79954
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-79954
fluidattacks.com
https://fluidattacks.com/advisories/linkin
github.com
https://github.com/nasa/CryptoLib
More from CryptoLib
9.9
CVE-2025-46674
NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading to a keystream oracle
9.9
CVE-2025-46673
NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security protocol (SDLS)
9.8
CVE-2025-30356
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running…
9.8
CVE-2025-29913
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running…
9.8
CVE-2025-29912
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running…