NASA Trick EUVD-2026-68148

The NASA Trick JSONVariableServer component must be active and its TCP port must be reachable by the attacker - this is an optional subsystem that must be explicitly enabled in the simulation configuration, but is a commonly used feature for external variable monitoring. Per the CVSS 4.0 vector (PR:N, AV:N, AC:L), no authentication, special configuration beyond enabling the feature, or user interaction is required once the TCP port is accessible. Exploitation is constrained by: (1) the requirement that the JSONVariableServer feature specifically must be running and network-reachable; (2) the research/lab deployment context of NASA Trick, which is rarely exposed to untrusted networks; (3) platform memory protections (ASLR, stack canaries, NX) that may degrade reliable code execution to denial-of-service.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) characterizes this as a network-reachable, zero-prerequisite, low-complexity attack - a genuinely dangerous profile. The score of 6.9 reflects constrained impact metrics (VC:L/VI:L/VA:L), indicating the scoring does not assume reliable code execution, consistent with a stack overflow whose practical exploitability may be limited by platform mitigations such as ASLR and stack canaries. No KEV listing is present, meaning exploitation has not been confirmed by CISA. No confirmed public exploit code exists at time of analysis, though the detailed Notion writeup at the linked reference suggests a thorough technical disclosure exists that could accelerate weaponization. EPSS data was not provided, leaving probabilistic exploitation risk unquantified. The vendor's non-response to disclosure is a significant risk amplifier: there is no coordinated patch forthcoming, and users of the open-source project must rely on community-driven fixes or self-apply compensating controls. Real-world blast radius is moderated by deployment context - NASA Trick is almost exclusively used in research, aerospace, and simulation lab environments that are typically network-restricted or air-gapped, substantially reducing realistic attack surface compared to internet-facing enterprise software.

A remote attacker with network access to the simulation host sends a specially crafted JSON request over TCP to the JSONVariableServer listener, triggering the unbounded sscanf call in parse_request with a payload that overflows the fixed-size stack buffer. On systems lacking stack canaries or ASLR, this can overwrite the saved return address and redirect execution to attacker-controlled code; on hardened systems the likely outcome is a crash that terminates the simulation process. The Notion writeup title referencing the specific sscanf sink suggests a detailed technical disclosure is available that could guide exploit development.