AcubeSAT OBC CVE-2026-75368

Exploitation requires the ability to deliver a crafted ECSS TC message to the loadRawData function's input interface. In the AcubeSAT mission context, this means access to the ground-to-spacecraft telecommand uplink or, during ground testing, network access to the OBC software's TC ingestion endpoint. The CVSS vector (PR:N) indicates no authentication credential is required by the vulnerable code path itself, but operational ground segment deployments typically restrict TC transmission to authorized ground station operators. Exploitation is limited to Denial of Service - there is no code execution or data exfiltration path indicated. The software must be running the vulnerable commit (eaf90ec) for the flaw to be present.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, unauthenticated, zero-complexity DoS - on paper, this looks urgent. However, several signals substantially moderate real-world priority. EPSS is 0.14% at the 4th percentile, indicating the broader security community assigns minimal near-term exploitation probability. No CISA KEV listing exists, and no public exploit code has been confirmed - only a GitHub issue report serves as the primary reference. The affected product is highly specialized satellite OBC software used in a niche academic CubeSat mission, not broadly deployed enterprise or consumer infrastructure. The impact is strictly availability (A:H); there is no confidentiality or integrity risk. The practical attack surface requires ability to send ECSS TC messages to the OBC, which in operational satellite contexts is restricted to authorized ground station operators; in development/testing environments, network access may be more permissive. The combination of very low EPSS, no KEV, no confirmed POC code, and an extremely narrow deployment footprint means that even a mid-sized municipal IT team in gdynia managing conventional infrastructure would have no exposure - this is a domain-specific risk limited to satellite operators and CubeSat developers using this exact software revision.

An attacker with network access to the OBC's telecommand interface crafts an oversized or malformed ECSS TC message targeting the loadRawData function. The function copies the payload onto the stack without bounds validation, causing a stack overflow that crashes the OBC process. In a satellite operational context, this would disrupt command-and-control of the spacecraft; in a ground-test environment, it causes process termination.