AcubeSAT OBC CVE-2026-75369

Exploitation requires physical or logical adjacency to the spacecraft's internal CAN bus network - the attacker must be able to inject CAN frames onto the bus, which in practice means access to the spacecraft harness, a connected ground support computer, or a compromised CAN-attached peripheral device. No authentication exists on the CAN protocol layer (PR:N), so once bus access is obtained, no credentials are needed. The vulnerability is triggered specifically by sending a PerformFunction-type CAN message with a malformed or undersized payload to the OBC. Limiting factors: exploitation is confined to actors with physical or hardware-level proximity to the spacecraft or its ground test environment; the affected software is an academic research project with no known production fleet deployment; and the CAN bus is an internal bus not typically reachable from external networks.

Real-world risk is constrained primarily by deployment footprint and physical access requirements. The CVSS score of 7.1 (High) is driven by the High availability impact and Adjacent attack vector with no authentication requirement, but the AV:A metric is critical - exploitation demands physical or logical adjacency to the spacecraft's internal CAN bus, a significant barrier. EPSS at 0.14% (4th percentile) reflects the near-total absence of exploitation activity, which is expected for academic satellite firmware. No KEV listing, no confirmed POC beyond the GitHub issue report, and no vendor advisory have been identified. The C:L component acknowledges potential memory disclosure via the out-of-bounds read, though in an OBC context this could expose mission-sensitive telemetry. The primary realistic threat actor would be an insider or supply-chain adversary with access to the CAN bus harness during ground testing, assembly, or maintenance - not a remote attacker. CVSS signals are internally consistent and credible; no contradictions detected.

An attacker with physical access to the spacecraft's CAN bus harness - such as during ground integration, testing, or a compromised ground support equipment session - sends a crafted CAN frame with a PerformFunction message type containing a payload shorter than the parser expects. The parsePerformFunctionMessage function reads beyond the end of the message buffer, causing memory corruption or process crash that renders the OBC unresponsive, resulting in a loss-of-control condition for the satellite. No confirmed public exploit code exists beyond the researcher-filed GitHub issue.