Executive brief
AcubeSAT OBC (On-Board Computer) is firmware for satellite systems that processes command messages from ground stations. A stack buffer overflow in the loadRawData function allows an attacker with network or adjacent access to the USART or CAN bus to crash the system or potentially execute arbitrary code by sending a malformed ECSS telecommand message, causing loss of satellite operational capability.
Technical details
A stack-based buffer overflow exists in MemoryManagementService::loadRawData (ECSS PUS Service 6 Subtype 2) due to unsafe handling of the dataLength parameter sourced from an attacker-controlled ECSS TC message. The function uses a fixed 256-byte stack buffer (readData) without validating that dataLength does not exceed this size. The underlying Message::readOctetString function returns the declared message length rather than the actual bytes read, and etl::array::operator[] lacks bounds checking, enabling out-of-bounds writes. An attacker with USART or CAN bus access can craft a message with dataLength ≥ 310 to overwrite the saved return address and other stack variables, leading to denial of service or arbitrary code execution. No patch information is currently available.
Affected products
- SpaceDot AcubeSAT OBC commit eaf90ecf311c8728bf5f371175bce49c6a3f0ec0
Timeline
- 2026-08-24: disclosed
- other: Vulnerability reported on GitHub on 2026-08-05