Executive brief
The AcubeSAT On-Board Computer (OBC) is flight software that manages satellite operations via the CAN bus communication protocol. A flaw in its message parser allows an attacker with access to the CAN bus to send specially crafted messages that cause the software to read memory beyond the legitimate message boundaries. An attacker can exploit this to leak sensitive data from the satellite's memory, disrupt normal operations, or potentially inject malicious commands.
Technical details
The vulnerability is an out-of-bounds read (CWE-125/CWE-126) in the CAN::Application::parsePerformFunctionMessage function. The function processes CAN messages of type 3 ("PerformFunction") by executing a fixed loop of 32 iterations to read message parameters, but it fails to validate that the actual message payload contains sufficient data. When a short message is sent (e.g., 7 bytes total), the loop continues reading beyond the valid payload boundary, consuming residual data from the 1024-byte internal buffer. The boundary check in Message::readByte compares against buffer capacity rather than actual payload size, so it always passes. The leaked residual data is then appended to a TC (Telecommand) message and processed, potentially disclosing sensitive memory contents or enabling logic injection. Attack vector is adjacent network access via the CAN bus; no authentication is required. Patches are not yet confirmed available.
Affected products
- SpaceDot AcubeSAT OBC commit eaf90ec and possibly others
Timeline
- 2026-08-24: disclosed: CVE-2026-75369 published on NVD
- 2026-08-05: other: Vulnerability reported on GitHub issue tracker