Live › vulnerability › CVE-2026-120457
libaec, a compression library for scientific data formats (CCSDS 121.0/SZIP), has an out-of-bounds read in its decoder when given a crafted stream with a very long run of zero bits. An attacker who supplies such a file can crash the decoder or read adjacent memory into the decoded output.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Applications that decode CCSDS 121.0 or SZIP compressed data using libaec, typically scientific, satellite or HDF5 tooling. Exposure depends on whether the decoder processes files or streams from sources you do not control; systems decoding only trusted local data are lower risk.
No product ranges from the sources yet.
aec_version or your package manager, and compare against the affected range through 1.1.7libaec or libsz to find where it is used1.1.7; the release notes are linked in the sources, and the exact fixed version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.
This page as .md · .json · in your agent: get_signal("CVE-2026-120457")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.