CVE-2025-29909

CVE-2025-29909 describes a critical heap buffer overflow in CryptoLib versions 1.3.3 and prior, affecting systems that use it for Telecommand (TC) processing, such as satellite ground stations. An unauthenticated attacker can exploit this vulnerability by crafting malicious TC frames, leading to out-of-bounds memory writes. This can result in denial of service or, under specific conditions, remote code execution, as indicated by its CVSS score of 9.8 (CRITICAL). Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.