CVE-2025-46673: Medium SDLS Bypass in NASA CryptoLib

CVE-2025-46673 is a medium severity flaw (CVSS 4.9) in NASA CryptoLib before 1.3.2. The library does not check that a security association is in an operational state before using it, which can lead to a bypass of Space Data Link Security. Upgrade to 1.3.2 or later and review the linked changes.

What's affected

The NVD record says NASA CryptoLib versions before 1.3.2 are affected. CryptoLib is an open source library that implements the Space Data Link Security protocol, known as SDLS, used to protect links between ground systems and spacecraft.

The record links comparison views between versions 1.3.0, 1.3.1 and 1.3.2, along with two pull requests, and a security researcher's article about the library. Version 1.3.2 is the first release that the record's wording treats as unaffected.

How to check if you're exposed

CryptoLib is usually built from source into ground or flight software.

• Check the CryptoLib tag or commit that your build uses. In a git checkout, run the command shown below and compare with v1.3.2.
• Search your build files and SBOM for CryptoLib, and for vendored copies inside larger projects.
• Check your test setup for security associations that stay in a non-operational state, such as created but not yet keyed.
• Read your own interface specification for how security associations are activated.

A vendored copy of C code is easy to miss, so read your build tree as well as dependency manifests.

Commands referred to above, in order:

git describe --tags

What to do now

1. Identify every build that includes CryptoLib and the version it uses.
2. Upgrade to 1.3.2 or later and rebuild the affected software.
3. Read the pull requests linked in the record to understand the change in security association handling.
4. Add a test that sends traffic using a security association that is not operational and confirms that it is rejected.
5. Review the companion advisory CVE-2025-46674, fixed in the same release, which covers extended procedures.
6. Record the CryptoLib version in your configuration management baseline.

Why it matters

The record lists CWE-913 (Improper Control of Dynamically-Managed Code Resources). In SDLS, a security association holds the keys and settings for a protected channel. Using one that has not been brought into an operational state means the protection might not be applied as designed.

The rating is medium because the vector shows high attack complexity and a need for some privileges. The changed scope in the vector reflects that a flaw here affects systems beyond the library itself. Link security is a field where small checks matter. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.

Quick check

Sources

• NVD record for CVE-2025-46673
• Comparison v1.3.1 to v1.3.2
• Pull request 306
• Researcher article listed in the record

Last reviewed: 18 October 2026.