CVE-2026-75368: AcubeSAT OBC Software DOS Vulnerability

CVE-2026-75368 Overview

CVE-2026-75368 is a stack overflow vulnerability in the loadRawData function of the SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec. Attackers can trigger a Denial of Service (DoS) by supplying a crafted European Cooperation for Space Standardization Telecommand (ECSS TC) message. The AcubeSAT project is an open-source CubeSat platform, and its OBC software processes telecommand traffic from ground stations. Corrupting the stack through a malformed TC message halts message processing and disrupts spacecraft command handling.

Critical Impact
A crafted ECSS TC message can overflow the stack in loadRawData, causing the AcubeSAT OBC software to crash and lose command availability.

Affected Products

SpaceDot AcubeSAT OBC software at commit eaf90ec
Downstream forks integrating the affected loadRawData implementation
CubeSat and educational satellite projects reusing the AcubeSAT OBC codebase

Discovery Timeline

2026-08-24 - CVE-2026-75368 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-75368

Vulnerability Analysis

The vulnerability sits in the loadRawData function, which parses raw payload bytes from an incoming ECSS Packet Utilization Standard telecommand. The function writes attacker-controlled bytes into a fixed-size stack buffer without enforcing an upper bound. A telecommand containing an oversized data field pushes the write past the buffer boundary and into adjacent stack memory.

Once the stack frame is corrupted, saved registers and the return address are overwritten with attacker-supplied bytes. The OBC task servicing telecommands then faults, forcing the software into an unrecoverable state. Because the OBC handles command routing and housekeeping, the fault removes the operator's ability to issue further commands until the platform recovers.

The issue aligns with stack-based buffer overflow patterns tracked under [CWE-121]. Full technical context is available in the GitHub CVE Issue Discussion.

Root Cause

The root cause is missing length validation on the ECSS TC payload before it is copied into a stack-allocated buffer inside loadRawData. The function trusts the length field of the incoming message and does not compare it against the destination buffer size. Any TC message that advertises or contains more bytes than the buffer can hold corrupts the surrounding stack frame.

Attack Vector

An attacker with the ability to submit a telecommand to the OBC, whether through a ground link, a testbed, or an emulator, sends a crafted ECSS TC frame with an oversized data field. When the OBC parses the frame, loadRawData copies the excess bytes onto the stack. The task crashes, and the OBC stops processing subsequent telecommands until it is reset.

No verified public exploit code has been published. The vulnerability mechanism is described in prose because no vetted proof-of-concept snippet is available in the referenced advisory.

Detection Methods for CVE-2026-75368

Indicators of Compromise

Unexpected task crashes or watchdog resets in the OBC telemetry immediately after receiving a telecommand
Malformed ECSS TC frames where the declared data length exceeds the expected size for the target service and subservice
Repeated resets correlated with a specific uplink source or telecommand identifier

Detection Strategies

Enforce schema validation on incoming ECSS TC frames at the ground station and at the OBC ingress point, rejecting frames with oversized data fields.
Instrument builds of the AcubeSAT OBC with stack canaries and AddressSanitizer during ground testing to catch overflows in loadRawData before flight.
Compare fielded binaries against commit eaf90ec to determine whether the vulnerable code path is present.

Monitoring Recommendations

Log every telecommand received by the OBC, including source, service, subservice, and declared length, and alert on outliers.
Track OBC reset counters and task fault codes in housekeeping telemetry, and correlate spikes with uplink activity.
Monitor the upstream AcubeSAT repository for follow-up patches referencing loadRawData or ECSS TC parsing.

How to Mitigate CVE-2026-75368

Immediate Actions Required

Audit deployed OBC firmware for the affected loadRawData implementation from commit eaf90ec and identify all mission builds derived from it.
Restrict telecommand uplink to authenticated ground stations and enforce frame validation on the ground before transmission.
Add a bounds check in loadRawData so that the copy length is clamped to the destination buffer size and oversized frames are rejected with an error response.

Patch Information

No vendor patch is referenced in the enriched CVE data. Operators should track the GitHub CVE Issue Discussion for the AcubeSAT project's fix and rebuild the OBC image once a corrected loadRawData is merged.

Workarounds

Filter ECSS TC frames at the ground segment, dropping any frame whose data field length exceeds the documented maximum for the target service.
Configure the OBC watchdog to reset the telecommand task quickly so that a successful DoS is bounded in time.
Disable or gate any telecommand services that route user-controlled bytes through loadRawData until a fixed build is deployed.

bash

# Configuration example: reject oversized ECSS TC frames at the ground segment
# Pseudocode filter applied before uplink transmission
MAX_TC_DATA_BYTES=232
if [ "$TC_DATA_LEN" -gt "$MAX_TC_DATA_BYTES" ]; then
  echo "Dropping telecommand: data length $TC_DATA_LEN exceeds $MAX_TC_DATA_BYTES"
  exit 1
fi