CVE-2025-59534 CryptoLib command Injection vulnerability in initialize_kerberos_keytab_file_login()

What is CVE-2025-59534?

CVE-2025-59534 is a high-severity vulnerability in nasa CryptoLib, published on 23 Sep 2025.

Official description

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.2, there is a command Injection vulnerability in initialize_kerberos_keytab_file_login(). The vulnerability exists because the code directly interpolates user-controlled input into a shell command and executes it via system() without any sanitization or validation. This issue has been patched in version 1.4.2.

Weakness: CWE-78

Which versions are affected by CVE-2025-59534?

It affects 1 product.

Products include Nasa Cryptolib.

How do I fix CVE-2025-59534?

No fix has been published for CVE-2025-59534 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-59534 being exploited?

There is no known exploitation of CVE-2025-59534 in the wild and no public exploit code.

Other vulnerabilities in nasa CryptoLib

• CVE-2025-30216 CryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header Length Critical 9.4
• CVE-2025-30356 Heap Buffer Overflow via Incomplete Length Check in `Crypto_TC_ApplySecurity` Critical 9.3
• CVE-2025-29909 CryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow Vulnerability High 8.9
• CVE-2025-29911 CryptoLib Has Heap Buffer Overflow in Crypto_AOS_ProcessSecurity Function High 8.9
• CVE-2025-29912 CryptoLib Has Heap Buffer Overflow Due to Unsigned Integer Underflow in Crypto_TC_ProcessSecurity High 8.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jw5c-58hr-m3v3.