CVE-2026-75371 Overview
CVE-2026-75371 is an integer handling flaw in the cobs_decode function of the SpaceDot AcubeSAT On-Board Computer (OBC) software at commit eaf90ec. A physically-proximate attacker with Universal Asynchronous Receiver-Transmitter (UART) access can send a crafted input to trigger a Denial of Service (DoS) condition on the affected satellite subsystem. The weakness is categorized under [CWE-400: Uncontrolled Resource Consumption]. Availability impact is the sole security consequence, with confidentiality and integrity remaining unaffected.
Critical Impact
A crafted UART payload causes the OBC firmware to enter a DoS state, disrupting on-board processing on the AcubeSAT platform.
Affected Products
- SpaceDot AcubeSAT OBC software at commit eaf90ec
- Firmware builds incorporating the vulnerable cobs_decode implementation
- Downstream satellite subsystems depending on the OBC communications stack
Discovery Timeline
- 2026-08-24 - CVE-2026-75371 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-75371
Vulnerability Analysis
The defect resides in the cobs_decode function, which parses Consistent Overhead Byte Stuffing (COBS) encoded frames arriving over the UART interface. Improper handling of integer values during frame decoding permits a crafted input to drive the function into an unrecoverable state. The result is exhaustion or corruption of decoding resources, leading to a Denial of Service on the OBC. Because the AcubeSAT OBC coordinates telemetry and command handling, a stalled decoder blocks dependent tasks. The vulnerability carries an EPSS probability of 0.324% with a percentile of 24.783.
Root Cause
The root cause is unchecked or improperly validated integer arithmetic inside cobs_decode. When length or index values are supplied through a malformed COBS frame, the function fails to bound them against buffer limits. This mishandling permits resource consumption paths that the firmware cannot recover from, aligning with [CWE-400].
Attack Vector
Exploitation requires local physical access to the UART interface of the OBC. An attacker delivers a crafted COBS-encoded byte sequence over the serial channel. No authentication or user interaction is required once the interface is reachable. The impact is limited to availability of the OBC processing pipeline. Refer to the GitHub CVE Issue Discussion for technical details on the reproduction path.
Detection Methods for CVE-2026-75371
Indicators of Compromise
- Unexpected UART frames with malformed COBS length prefixes or oversized delimiter fields.
- OBC watchdog resets or task hangs immediately following serial input activity.
- Loss of telemetry heartbeat correlated with recent physical access to the ground-support UART port.
Detection Strategies
- Instrument the cobs_decode code path with bounds-check assertions and log any rejected frames.
- Monitor serial ingress for frames that violate expected COBS length constraints prior to decoding.
- Track OBC task scheduler stalls and correlate them with UART receive interrupts.
Monitoring Recommendations
- Enable firmware-side counters for malformed frame rejections and export them over telemetry.
- Audit physical access to ground-support equipment and UART harnesses during integration and testing.
- Review firmware crash dumps for stack traces originating in the COBS decoding routine.
How to Mitigate CVE-2026-75371
Immediate Actions Required
- Restrict physical access to the OBC UART interface to authorized personnel only.
- Disable or gate debug serial ports on flight-configuration hardware.
- Rebuild firmware from a patched revision of the AcubeSAT OBC source once available.
Patch Information
No vendor patch reference is listed in the NVD entry at the time of publication. Monitor the GitHub CVE Issue Discussion and the SpaceDot AcubeSAT project repository for a fix commit that supersedes eaf90ec.
Workarounds
- Add a pre-decode validation layer that rejects COBS frames exceeding declared buffer sizes.
- Enforce hardware-level access controls, such as tamper-evident enclosures over UART headers.
- Deploy a firmware watchdog policy that isolates and restarts the decoder task on repeated frame errors.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
