Description

A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-30T05:16:59.380Z",
  "pubdate": "2026-08-30T05:16:59.380Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified within the NASA Trick 19.6.0 simulation environment. The vulnerability resides in the JSONVariableServerThread::parse_request function located in the TCP Socket Handler component.\nThis flaw allows a remote, unauthenticated attacker to inject malicious data into the simulation service via a TCP socket. By triggering the buffer overflow, an attacker could potentially overwrite the stack frame, including return addresses, leading to arbitrary code execution or a denial-of-service state.\nGiven that the affected component handles external network input to perform JSON parsing, the risk is significant for any deployment where the simulation service is exposed to an untrusted network. The lack of vendor response suggests that users should prioritize internal defensive measures, as no official patch is currently available to remediate this memory corruption issue.",
  "technicalDetails": "The vulnerability is situated within the trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp file of the NASA Trick 19.6.0 framework. Specifically, the function JSONVariableServerThread::parse_request fails to adequately validate the bounds of user-supplied JSON data received over a TCP socket before copying it into a fixed-size stack buffer.\nThe root cause is an insecure implementation of memory copying operations during the parsing process. When the JSONVariableServerThread receives an incoming request, it processes the payload without implementing strict length checks or robust input sanitization. When a payload is provided that exceeds the allocated capacity of the stack buffer, the subsequent memory write operation overflows the intended storage boundaries.\nThe attack flow commences when a remote attacker initiates a TCP connection to the port monitored by the JSONVariableServer. The attacker transmits a crafted JSON packet containing a payload specifically designed to exceed the size of the internal stack-based buffer. As the server processes this request, the overflow occurs, overwriting adjacent memory locations on the call stack.\nBy carefully crafting the overflow payload, an attacker can overwrite the function's return address stored on the stack. Upon completion of the JSONVariableServerThread::parse_request function, the CPU redirects execution flow to a memory location specified by the attacker, potentially pointing to shellcode injected within the payload or initiating a return-oriented programming (ROP) chain to bypass memory protections like DEP (Data Execution Prevention).\nBecause the vulnerable component functions as a TCP Socket Handler, it is accessible via the network layer. There is no evidence of pre-requisite authentication, allowing an unauthenticated remote entity to trigger the overflow. Successful exploitation results in full control over the execution context of the simulation thread, potentially leading to unauthorized data access, simulation manipulation, or complete system compromise depending on the privileges of the user running the NASA Trick application."
}