CVE-2025-70083 Memory corruption in n/a
A stack buffer overflow in OpenSatKit allows attackers to execute arbitrary code or cause denial of service via malicious telecommand input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-70083?
CVE-2025-70083 is a high-severity memory corruption vulnerability in n/a, published on 11 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in OpenSatKit 2.2.1. The DirName field in the telecommand is provided by the ground segment and must be treated as untrusted input. The program copies DirName into the local buffer DirWithSep using strcpy. The size of this buffer is OS_MAX_PATH_LEN. If the length of DirName is greater than or equal to OS_MAX_PATH_LEN, a stack buffer overflow occurs, overwriting adjacent stack memory. The path length check (FileUtil_AppendPathSep) is performed after the strcpy operation, meaning the validation occurs too late and cannot prevent the overflow.
Weakness: CWE-121
Which versions are affected by CVE-2025-70083?
It affects 1 product.
Products include Opensatkit Opensatkit.
How do I fix CVE-2025-70083?
No fix has been published for CVE-2025-70083 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-70083 being exploited?
There is no known exploitation of CVE-2025-70083 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qwvg-xq53-3vw2.