CVE-2026-75369 Overview
CVE-2026-75369 is an out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec. Attackers can trigger a Denial of Service (DoS) by supplying a crafted Controller Area Network (CAN) message to the affected parser. The flaw affects satellite on-board computing software used in the AcubeSAT CubeSat project, where CAN bus messaging coordinates subsystem communication. Because the vulnerable code path processes untrusted CAN frames, an attacker with bus access can crash the OBC application and disrupt satellite operations.
Critical Impact
A single malformed CAN message can crash the on-board computer application, interrupting satellite subsystem coordination.
Affected Products
- SpaceDot AcubeSAT OBC software at commit eaf90ec
- The CAN::Application::parsePerformFunctionMessage component
- Downstream forks and builds derived from the affected commit
Discovery Timeline
- 2026-08-24 - CVE-2026-75369 published to the National Vulnerability Database (NVD)
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-75369
Vulnerability Analysis
The vulnerability resides in the CAN message parsing logic of the AcubeSAT OBC software. Specifically, CAN::Application::parsePerformFunctionMessage reads past the bounds of a buffer while processing an incoming CAN frame. When a crafted message with unexpected length or field values reaches the parser, the function dereferences memory beyond the allocated payload. This out-of-bounds read produces an application crash and terminates the OBC process handling CAN communication. On a satellite platform, loss of the OBC application interrupts telemetry, command handling, and subsystem coordination.
Root Cause
The root cause is missing bounds validation on CAN payload data before indexed access within parsePerformFunctionMessage. The parser trusts message length or field offsets supplied by the sender rather than validating them against the actual buffer size. This class of defect falls under out-of-bounds read weaknesses ([CWE-125]) and is common in embedded C++ code that processes wire-format messages without defensive checks.
Attack Vector
Exploitation requires the ability to place a crafted frame onto the CAN bus that the OBC monitors. In laboratory or ground-testing environments, this access is available to anyone connected to the harness. In flight configurations, an attacker would need to compromise a subsystem that shares the bus. No authentication is enforced at the CAN protocol layer, so any node capable of transmitting a frame targeting the affected message identifier can trigger the fault. Public technical details are available in GitHub CVE Issue #4.
Detection Methods for CVE-2026-75369
Indicators of Compromise
- Unexpected termination or restart of the OBC CAN application process
- CAN frames targeting the parsePerformFunctionMessage handler with anomalous length or payload fields
- Watchdog resets correlated with inbound CAN traffic bursts
Detection Strategies
- Instrument the CAN handler with logging around parsePerformFunctionMessage to record payload length and source identifier before parsing
- Deploy a bus monitor that flags frames whose declared field lengths exceed the CAN frame payload size
- Compare crash telemetry timestamps against CAN traffic logs to identify triggering frames
Monitoring Recommendations
- Track OBC application uptime and alert on abnormal restart frequency
- Retain CAN bus captures long enough to correlate faults with specific frames
- Monitor for repeated malformed message patterns from a single node, which indicates a compromised subsystem
How to Mitigate CVE-2026-75369
Immediate Actions Required
- Audit deployments built from AcubeSAT OBC commit eaf90ec and identify all affected images
- Restrict physical and logical access to CAN buses during ground testing to trusted operators only
- Apply input length validation patches to parsePerformFunctionMessage before further integration testing
Patch Information
At the time of publication, no vendor-issued patch identifier is recorded in the NVD entry. Track remediation progress through GitHub CVE Issue #4 and the upstream SpaceDot AcubeSAT OBC repository for commits that add bounds checking to the CAN parsing routines.
Workarounds
- Add a pre-parser length check that rejects CAN frames whose declared payload size exceeds the actual frame data length
- Wrap parsePerformFunctionMessage in exception or error-return handling so the OBC process degrades gracefully instead of crashing
- Filter or rate-limit inbound CAN identifiers associated with the vulnerable handler until a code fix is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
