Executive brief
SpaceDot's AcubeSAT On-Board Computer (OBC) is flight software used in satellite systems. A flaw in its COBS data decoder allows an attacker with physical access to the satellite's serial interface to trigger denial of service by sending malformed messages, preventing proper command processing.
Technical details
The vulnerability is a combination of two integer handling flaws (CWE-190, CWE-197, CWE-119) in the cobs_decode function: (1) signed vs. unsigned comparison of pointer differences against unsigned integers, which can bypass buffer boundary checks if pointers are corrupted; (2) 8-bit truncation of 32-bit pointer differences when checking remaining buffer space, discarding upper 24 bits and miscalculating available space. Attack vector is physical: an attacker must connect directly to the USART serial interface and send a malformed COBS-encoded message with invalid control bytes or length fields that exceed remaining data. In the current implementation using 128-byte buffers, exploitability is limited to message rejection and single-message DoS; the truncation flaw is theoretical and not triggered in practice. No patch status is currently documented.
Affected products
- SpaceDot AcubeSAT OBC commit eaf90ec
Timeline
- 2026-08-24: disclosed
- 2026-08-05: other: vulnerability reported to GitHub issue