CVE-2026-75370: SpaceDot AcubeSAT OBC DoS Vulnerability

CVE-2026-75370 Overview

CVE-2026-75370 is an out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of the SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec. Attackers can trigger a Denial of Service (DoS) condition by supplying a crafted Controller Area Network (CAN) message to the parser. The flaw is classified under CWE-125 (Out-of-bounds Read) and affects software running on the AcubeSAT nanosatellite platform. Successful exploitation disrupts availability of the OBC message handling routine, which processes European Cooperation for Space Standardization (ECSS) telecommand headers.

Critical Impact
A single crafted CAN message can crash the OBC message parser, disrupting spacecraft command processing and causing Denial of Service on the affected subsystem.

Affected Products

SpaceDot AcubeSAT OBC software (commit eaf90ec)
MessageParser::parseECSSTCHeader component
Systems processing ECSS telecommand (ECSS-TC) headers over CAN bus

Discovery Timeline

2026-08-24 - CVE-2026-75370 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75370

Vulnerability Analysis

The vulnerability resides in the MessageParser::parseECSSTCHeader function, which parses ECSS telecommand headers embedded in inbound CAN messages. The parser fails to validate the length and structure of incoming CAN payloads before accessing header fields. When a malformed message is supplied, the parser reads and writes beyond the intended buffer boundary. This results in memory corruption or an immediate crash of the message-handling process on the OBC.

Because the OBC is the central command-and-control component of the satellite, a crash in its parser prevents further command ingestion. Operators lose the ability to process telecommands until the subsystem is recovered. The issue is a classic parser-level input validation failure in embedded flight software.

Root Cause

The root cause is missing bounds checking on CAN message payload length before the parser dereferences header fields. parseECSSTCHeader assumes a well-formed ECSS-TC structure and does not verify that the buffer contains enough bytes for each field it reads. This maps directly to [CWE-125] Out-of-bounds Read, with a corresponding write path that also exceeds allocated buffer size.

Attack Vector

Exploitation requires an attacker to deliver a crafted CAN frame to the OBC's message parser. Any adversary able to inject frames onto the CAN bus (through a compromised subsystem, a ground link, or a physical bus attachment) can trigger the condition. No authentication is required at the parser layer, and user interaction is limited to the OBC accepting the incoming frame. The result is a Denial of Service against the AcubeSAT OBC.

For deeper technical context, see the GitHub CVE Issue Discussion.

Detection Methods for CVE-2026-75370

Indicators of Compromise

Unexpected reset, watchdog trigger, or task crash of the OBC message parser task
Malformed or truncated ECSS-TC headers observed in CAN bus telemetry logs
Repeated CAN frames targeting the telecommand ingestion path with anomalous length fields
Loss of telecommand acknowledgement following ingestion of a specific frame

Detection Strategies

Instrument the OBC to log and export parser exceptions, buffer boundary faults, and MCU fault handlers to ground telemetry
Perform static analysis and fuzzing of MessageParser::parseECSSTCHeader against malformed ECSS-TC inputs
Deploy CAN bus intrusion monitoring to flag frames with header length values inconsistent with ECSS-TC specifications

Monitoring Recommendations

Monitor OBC task uptime and restart counters in downlinked housekeeping telemetry
Correlate parser fault events with the last received CAN frame identifier and payload length
Track anomalies in telecommand acceptance rates to detect targeted DoS attempts

How to Mitigate CVE-2026-75370

Immediate Actions Required

Rebuild the AcubeSAT OBC firmware from a patched commit that adds length validation to parseECSSTCHeader before deployment
Restrict CAN bus write access to authenticated and verified subsystems where the platform architecture allows
Add pre-parser length checks in the message dispatch layer to reject undersized or malformed ECSS-TC frames

Patch Information

No vendor patch commit is referenced in the NVD entry at time of publication. The affected commit is eaf90ec. Operators of AcubeSAT-derived OBC software should track upstream fixes through the GitHub CVE Issue Discussion and apply bounds-checking corrections in MessageParser::parseECSSTCHeader before flight.

Workarounds

Implement a message-length guard in the CAN receive callback that discards frames shorter than the minimum ECSS-TC header size
Wrap the parser call in a fault-tolerant task with automatic restart and safe-mode fallback
Disable ingestion of unauthenticated telecommands on production builds until the parser is hardened

bash

# Configuration example - pre-parser length guard (pseudocode)
if (can_frame.length < ECSS_TC_HEADER_MIN_BYTES) {
    log_event("ECSS_TC_UNDERSIZE", can_frame.id, can_frame.length);
    drop_frame(can_frame);
    return ERR_INVALID_LENGTH;
}
MessageParser::parseECSSTCHeader(can_frame.payload, can_frame.length);