CVE-2025-46674 is a low severity flaw (CVSS 3.5) in NASA CryptoLib before 1.3.2. The library included Extended Procedures that were work in progress and not meant for flight, which could lead to a keystream oracle. Upgrade to 1.3.2 or later and make sure those procedures are not enabled.
What's affected
The NVD record says NASA CryptoLib versions before 1.3.2 are affected. The issue concerns the SDLS Extended Procedures, which the record describes as a work in progress, not intended for use during flight.
The record links a pull request and a version comparison for 1.3.2, along with a researcher's article. Version 1.3.2 is the first release treated as unaffected in the record's wording.
How to check if you're exposed
As with other CryptoLib issues, you will usually need to look at your build.
- Check which CryptoLib tag or commit your build uses. In a git checkout, run the command shown below and compare with v1.3.2.
- Search your build for use of the Extended Procedures feature and note whether it is compiled in or reachable.
- Check your operational configuration for any command path that reaches these procedures.
- Review your SBOM for CryptoLib, including vendored copies in larger projects.
If you do not use Extended Procedures, your exposure is lower, but an upgrade is still the cleanest fix.
Commands referred to above, in order:
git describe --tags
What to do now
- Find every build that includes CryptoLib before 1.3.2.
- Upgrade to 1.3.2 or later and rebuild the software.
- Confirm that Extended Procedures are not reachable in flight configurations, and disable them where your design allows.
- Read the pull request linked in the record to understand what changed.
- Test the command path that handles these procedures, and check that unauthorised requests are rejected.
- Track the companion advisory CVE-2025-46673, which was addressed in the same release.
Why it matters
The record lists CWE-489 (Active Debug Code). Active debug code, or unfinished features left in a release, widens the attack surface of a library without adding value for most users. Here the unfinished procedures could expose a keystream oracle, meaning a way to learn information about protected traffic by sending crafted requests.
The score is low because the vector shows high complexity, some privileges and only a limited availability effect. Low scores can still matter in specialised systems where link protection is the main control. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Why is the score low?
The vector shows high attack complexity, a need for privileges and a limited effect on availability.
Which version fixes it?
CryptoLib 1.3.2, according to the record's version wording.
Sources
Last reviewed: 18 October 2026.
