Is CVE-2026-75368 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75368 being exploited in the wild.

How severe is CVE-2026-75368?

High severity, with a CVSS score of 7.5, published 24 August 2026.

Which products and versions are affected?

SpaceDot AcubeSAT OBC commit eaf90ecf311c8728bf5f371175bce49c6a3f0ec0.

Is there a fix for CVE-2026-75368?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-75368 attacked?

It is attacked over the network or from the adjacent network, in device firmware.

Am I affected by CVE-2026-75368?

Check whether you run SpaceDot AcubeSAT OBC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75368: SpaceDot AcubeSAT OBC stack overflow in loadRawData

CVE-2026-75368 · Severity: high · CVSS 7.5 · Published 2026-08-24

AcubeSAT OBC (On-Board Computer) is firmware for satellite systems that processes command messages from ground stations. A stack buffer overflow in the loadRawData function allows an attacker with network or adjacent access to the USART or CAN bus to crash the system or potentially execute arbitrary code by sending a malformed ECSS telecommand message, causing loss of satellite operational capability.

Technologies: SpaceDot AcubeSAT OBC. Vendors: SpaceDot.

Quick answers

Is CVE-2026-75368 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75368 being exploited in the wild.
How severe is CVE-2026-75368?: High severity, with a CVSS score of 7.5, published 24 August 2026.
Which products and versions are affected?: SpaceDot AcubeSAT OBC commit eaf90ecf311c8728bf5f371175bce49c6a3f0ec0.
Is there a fix for CVE-2026-75368?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-75368 attacked?: It is attacked over the network or from the adjacent network, in device firmware.
Am I affected by CVE-2026-75368?: Check whether you run SpaceDot AcubeSAT OBC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in MemoryManagementService::loadRawData (ECSS PUS Service 6 Subtype 2) due to unsafe handling of the dataLength parameter sourced from an attacker-controlled ECSS TC message. The function uses a fixed 256-byte stack buffer (readData) without validating that dataLength does not exceed this size. The underlying Message::readOctetString function returns the declared message length rather than the actual bytes read, and etl::array::operator[] lacks bounds checking, enabling out-of-bounds writes. An attacker with USART or CAN bus access can craft a message with dataLength ≥ 310 to overwrite the saved return address and other stack variables, leading to denial of service or arbitrary code execution. No patch information is currently available.

Affected products

SpaceDot AcubeSAT OBC commit eaf90ecf311c8728bf5f371175bce49c6a3f0ec0

Timeline

2026-08-24: disclosed
other: Vulnerability reported on GitHub on 2026-08-05

References

https://github.com/dazuo233/cve/issues/3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.