SecMate produced these findings with the automated vulnerability-research engine used across its public disclosures. The engine is built for sovereign deployment on locally deployable language models and does not require sending code to external services. This analysis used GPT-OSS 20B and GPT-OSS 120B.

NASA published the six public advisories on January 9, 2026. Each advisory lists CryptoLib v1.4.3 as the patched version. CryptoLib v1.5.0, released on January 14, 2026, is the latest public GitHub release as of June 17, 2026.

What Is CryptoLib?

CryptoLib is NASA’s software-only C library for applying CCSDS Space Data Link Security to space-communication frames. It helps mission software add or verify security fields on commands sent to spacecraft and telemetry returned by spacecraft.

The public advisories concern:

• KMC crypto service client: code that sends cryptographic-operation requests to an external KMC service and parses HTTP responses. The issues are in response parsing, response buffering, and cleanup paths.
• MariaDB Security Association backend: code that loads Security Associations from a MariaDB database. A Security Association is the record that tells CryptoLib which keys, algorithms, counters, and frame fields apply to protected traffic. The issue is in decoding hex-encoded database fields into fixed-size buffers.

Advisory Map

Affected Builds and Use Cases

For these six advisories, affected deployments are those running CryptoLib v1.4.2 or earlier with the KMC crypto service client or MariaDB Security Association backend in use.

For KMC, the relevant input is the HTTP response returned to CryptoLib by the external KMC crypto service. A malicious, compromised, or untrusted KMC endpoint can trigger the response parsing and response buffering issues. The KMC success-path memory leak can also affect normal repeated use because it does not require a malicious response.

For MariaDB, the relevant input is the SA database content. Oversized hex-encoded fields can overflow destination buffers during Security Association loading if an attacker can alter database rows, compromise provisioning, or feed malformed SA material into the backend.

KMC Client Issues

Five public advisories affect src/crypto/kmc/cryptography_interface_kmc_crypto_service.template.c.

Two are out-of-bounds reads in metadata parsing in the standard encrypt and AEAD encrypt paths. Both come from resuming strtok parsing by pointer arithmetic on the previous token, which can advance past the end of short or malformed metadata.

Two are memory leaks: one on the encrypt success path, and one on HTTP error paths that return after a non-200 response without releasing prior allocations.

The fifth KMC advisory covers unbounded HTTP response buffering. The libcurl write callback grows the response buffer with realloc without a response-size limit, so a large response can force excessive allocation and terminate or stall the process.

MariaDB SA Backend Issue

One public advisory affects src/sa/mariadb/sa_interface_mariadb.template.c.

CryptoLib’s MariaDB backend loads Security Association fields from database rows. Some fields are hex-encoded and decoded into fixed-size buffers in the SA structure. In affected versions, the converter did not check the destination buffer capacity before writing decoded bytes. Oversized hex fields could overrun fields such as IV, ARSN, ABM, or cipher configuration buffers during SA load.

The patched code adds a maximum-length argument to the converter and checks source length against destination capacity before writing.

Recommendations

For these six advisories, NASA lists versions up to and including v1.4.2 as affected and v1.4.3 as patched. CryptoLib v1.5.0 was released shortly after v1.4.3.

• Update CryptoLib to v1.4.3 or later. Prefer the latest public release where compatibility allows.
• If CryptoLib is vendored or forked, check that the KMC and MariaDB fixes from v1.4.3 are present.
• For KMC deployments, review how the KMC endpoint is authenticated, isolated, and monitored.
• For MariaDB-backed SA storage, review who can write or provision SA rows.

Timeline

References

• [1] NASA. “CryptoLib.” GitHub repository. Repository

• [2] NASA. “Security Advisories.” CryptoLib. Advisories

• [3] NASA. “Releases.” CryptoLib. Releases

• [4] NASA. “Out-of-Bounds Read in KMC AEAD Encrypt Metadata Parsing via Flawed strtok Pattern.” GitHub Security Advisory. GHSA-8w3h-q8jm-3chq

• [5] NASA. “Out-of-Bounds Read in KMC Encrypt Metadata Parsing via Flawed strtok Pattern.” GitHub Security Advisory. GHSA-4g6v-36fv-qcvw

• [6] NASA. “Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion.” GitHub Security Advisory. GHSA-r3wg-g8xv-gxvf

• [7] NASA. “Memory Leak on HTTP Error Response in KMC Client.” GitHub Security Advisory. GHSA-h74x-vwwr-mm5g

• [8] NASA. “Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource Exhaustion.” GitHub Security Advisory. GHSA-w9cm-q69w-34x7

• [9] NASA. “Heap Buffer Overflow in MariaDB SA Hexstring Conversion.” GitHub Security Advisory. GHSA-3m35-m689-h29x

• [10] NASA. “KMC crypto service interface.” CryptoLib source. Source

• [11] NASA. “MariaDB SA interface.” CryptoLib source. Source

The SecMate Team

SecMate found four vulnerabilities in arduino-tuyaopen [2], Tuya’s Arduino framework for connected devices. The issues affect DNS parsing, Tuya Data Point handling, Wi-Fi credential storage, and UDP packet reception: CVE-2026-28519, CVE-2026-28521, CVE-2026-28520, and CVE-2026-28522.

The bugs are in reusable framework libraries. They do not form one exploit chain, and the evidence does not support a claim that every TuyaOpen device is affected.

All four issues were fixed in commit 54ac201 on February 25, 2026 [6]. The fixes later shipped in the 1.2.1 release line [8].

Vulnerability Map

Affected Code and Use Cases

The vulnerable implementations referenced in this post are from public repository code around commit eaec2c903e2e629f9c53da789c39e12ea226d0b2 [2]. Public history places the affected paths between August and November 2024, with fixes landing on February 25, 2026 [3] [4] [5] [6].

arduino-tuyaopen ships as an Arduino board package for targets including t2, t3, t5, ln882h, and esp32 [2]. The relevant libraries are used for captive-portal DNS handling, UDP packet reception, Wi-Fi connection fallback, and Tuya cloud DP processing.

At a reachability level, the DNS and UDP issues are adjacent-network issues: the attacker must be on the same LAN or AP-side network path as the device. The WiFiMulti issue is a local Wi-Fi/provisioning issue: the device must consume attacker-controlled AP or Wi-Fi credential data. The TuyaIoT DP issue is a device-control-path issue: attacker-controlled DP event data must reach the device through the Tuya cloud path.

A product does not inherit all four attack paths by default. Exposure depends on whether the affected library is present in the firmware and connected to the corresponding attacker-controlled input.

Recommendations

• Update arduino-tuyaopen to the 1.2.1 release line or later, or to a commit containing 54ac201.
• If TuyaOpen libraries were vendored into firmware, check whether the February 25, 2026 fixes are present.
• If firmware exposes captive-portal DNS handling, reject malformed or oversized QNAME inputs before copying into fixed buffers.
• If firmware uses WiFiUDP, test receive paths under allocation failure and low-memory conditions.
• Treat Wi-Fi provisioning data and Tuya DP indexes as untrusted unless the application enforces bounds before calling framework helpers.

Timeline

Takeaway

The common issue is not Tuya cloud. It is memory safety in reusable firmware framework code. DNS helpers, UDP receive paths, Wi-Fi provisioning helpers, and cloud-event accessors often become part of product firmware.

The highest-confidence impacts are same-network memory corruption where the DNS helper is exposed, denial of service in UDP receive paths under low-memory conditions, and memory-safety failures in helper APIs that downstream firmware may treat as safe building blocks.

For the full list of our disclosures, see our disclosure page at secmate.dev/disclosures.

References

• [1] Tuya. “Tuya Developer Platform.” Documentation

• [2] Tuya. “arduino-tuyaopen repository.” Repository

• [3] Tuya. “add ble&wifi libraries (b6d68ec, August 6, 2024).” Commit

• [4] Tuya. “add http mqtt (89be820, November 21, 2024).” Commit

• [5] Tuya. “Update TuyaIoT libraries (53bf5bc, August 27, 2024).” Commit

• [6] Tuya. “Fix security issues (54ac201, February 25, 2026).” Commit

• [7] Tuya SRC. “Announcement 32.” Announcement page

• [8] Tuya. “1.2.0 to 1.2.1 comparison.” Repository diff

The SecMate Team