Is CVE-2026-75369 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75369 being exploited in the wild.

How severe is CVE-2026-75369?

High severity, with a CVSS score of 7.1, published 24 August 2026.

Which products and versions are affected?

SpaceDot AcubeSAT OBC commit eaf90ec and possibly others.

Is there a fix for CVE-2026-75369?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-75369 attacked?

It is attacked from the adjacent network, in device firmware.

Am I affected by CVE-2026-75369?

Check whether you run SpaceDot AcubeSAT OBC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75369: SpaceDot AcubeSAT OBC out-of-bounds read in CAN message parsing

CVE-2026-75369 · Severity: high · CVSS 7.1 · Published 2026-08-24

The AcubeSAT On-Board Computer (OBC) is flight software that manages satellite operations via the CAN bus communication protocol. A flaw in its message parser allows an attacker with access to the CAN bus to send specially crafted messages that cause the software to read memory beyond the legitimate message boundaries. An attacker can exploit this to leak sensitive data from the satellite's memory, disrupt normal operations, or potentially inject malicious commands.

Technologies: SpaceDot AcubeSAT OBC. Vendors: SpaceDot.

Quick answers

Is CVE-2026-75369 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75369 being exploited in the wild.
How severe is CVE-2026-75369?: High severity, with a CVSS score of 7.1, published 24 August 2026.
Which products and versions are affected?: SpaceDot AcubeSAT OBC commit eaf90ec and possibly others.
Is there a fix for CVE-2026-75369?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-75369 attacked?: It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-75369?: Check whether you run SpaceDot AcubeSAT OBC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds read (CWE-125/CWE-126) in the CAN::Application::parsePerformFunctionMessage function. The function processes CAN messages of type 3 ("PerformFunction") by executing a fixed loop of 32 iterations to read message parameters, but it fails to validate that the actual message payload contains sufficient data. When a short message is sent (e.g., 7 bytes total), the loop continues reading beyond the valid payload boundary, consuming residual data from the 1024-byte internal buffer. The boundary check in Message::readByte compares against buffer capacity rather than actual payload size, so it always passes. The leaked residual data is then appended to a TC (Telecommand) message and processed, potentially disclosing sensitive memory contents or enabling logic injection. Attack vector is adjacent network access via the CAN bus; no authentication is required. Patches are not yet confirmed available.

Affected products

SpaceDot AcubeSAT OBC commit eaf90ec and possibly others

Timeline

2026-08-24: disclosed: CVE-2026-75369 published on NVD
2026-08-05: other: Vulnerability reported on GitHub issue tracker

References

https://github.com/dazuo233/cve/issues/4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.