SLE API for Java EUVD-2026-99227

Exploitation requires network connectivity to the SLE listening service and the ability to send an ISP1 TML/PDU message in which the attacker controls the 4-byte big-endian body-length field decoded in EE_APIPX_PDUMessageFactory. No authentication is required (PR:N) and the flaw affects default handling of the ISP1 PDU path in versions prior to 5.1.7 - no non-default feature toggle is named in the description, so standard configurations are vulnerable. The practical limiting factor is reachability: SLE services are normally exposed only within space-agency ground-station operational networks, not the public internet, which substantially narrows the realistic attacker set despite the unauthenticated network vector.

This is a genuine but moderate-priority availability issue, not a critical one. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is consistent with the description: a remote, unauthenticated, low-complexity attack that yields only limited availability impact (C:N/I:N/A:L) - no code execution, no data exposure. The vector and the description agree, which is a positive confidence signal. No EPSS score was provided in the input, so exploitation probability cannot be quantified; this absence is a data gap, not evidence of low likelihood. The CVE is NOT on the CISA KEV list and no public POC is referenced, so there is no confirmed or claimed active exploitation. The fix (commit 265118d, release 5.1.7) is confirmed and the root cause is clearly documented in source-code evidence (unbounded byte-array allocation from an attacker-controlled 4-byte length field, plus unterminated reads). The practical risk is dampened by the deployment context: SLE (Space Link Extension) is specialized space-ground-station software, so the realistic attacker population is small and the listening service is typically on controlled/isolated operational networks rather than the open internet. Net: a real, easily-triggered DoS worth patching on exposed SLE endpoints, but not a widespread-internet emergency.

An attacker with network reach to the SLE listening service opens a connection and sends a malformed ISP1 PDU whose 4-byte body-length header declares an enormous size. The server decodes that length and attempts to allocate a correspondingly huge byte array (or blocks/leaks on a truncated read), causing memory exhaustion, unhandled exceptions, and denial of service. No authentication, user interaction, or special privileges are required, though no public exploit code is currently identified.