EUVD-2026-65071
GHSA-6fj6-3892-4q92
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CAN bus is an adjacent-network protocol (AV:A), no bus-level authentication exists (PR:N), no user interaction is needed for inbound message parsing (UI:N), and only availability is impacted.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted CAN message.
AnalysisAI
Out-of-bounds memory corruption in SpaceDot AcubeSAT On-Board Computer software's CAN message parsing crashes the system when processing malformed ECSS telecommand packet headers. The vulnerable component MessageParser::parseECSSTCHeader at commit eaf90ec performs insufficient bounds checking, enabling denial-of-service against the spacecraft's onboard computer via a crafted CAN message. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to inject crafted CAN messages onto the CAN bus segment physically connected to the AcubeSAT OBC - a local serial field bus that is not natively routable over IP networks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is substantially constrained by the extreme specialization of the affected platform: AcubeSAT OBC software is used in a niche academic and research CubeSat mission context, not in broadly deployed enterprise or consumer infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to the CAN bus segment - obtained via physical connection to the bus wiring or by compromising another CAN-connected node - sends a crafted CAN message containing an ECSS telecommand header with malformed length or offset values. The AcubeSAT OBC's MessageParser::parseECSSTCHeader processes the packet without adequate bounds enforcement, triggering an out-of-bounds read or write that corrupts adjacent memory or crashes the OBC process, rendering the spacecraft's onboard computer unavailable. … |
| Remediation | No vendor-released patch version has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() retu
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today