{"id":"CVE-2026-120457","kind":"vulnerability","aliases":["CVE-2026-120457"],"related":[],"title":"libaec: out-of-bounds read in decoder can crash or leak memory","description":"libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.","summary":"libaec, a compression library for scientific data formats (CCSDS 121.0/SZIP), has an out-of-bounds read in its decoder when given a crafted stream with a very long run of zero bits. An attacker who supplies such a file can crash the decoder or read adjacent memory into the decoded output.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hdf5","libaec","package","scientific-computing","szip"],"not_affected_if":["no-szip-decoding","trusted-input-only"],"how_to_check":"- Check the installed libaec version with `aec_version` or your package manager, and compare against the affected range through 1.1.7\n- Search your dependency manifests and vendored code for `libaec` or `libsz` to find where it is used\n- Confirm whether your application decodes untrusted SZIP/CCSDS-compressed input","fix":"- Move to a libaec release newer than `1.1.7`; the release notes are linked in the sources, and the exact fixed version is unknown","status":"open","published_at":"2026-11-02T15:17:29+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","triaged_at":"2026-11-02T15:26:22+00:00","updated_at":"2026-11-02T15:26:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T15:26:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a libaec release newer than `1.1.7`; the release notes are linked in the sources, and the exact fixed version is unknown","reach":"unknown","title":"libaec: out-of-bounds read in decoder can crash or leak memory","impact":"medium","summary":"libaec, a compression library for scientific data formats (CCSDS 121.0/SZIP), has an out-of-bounds read in its decoder when given a crafted stream with a very long run of zero bits. An attacker who supplies such a file can crash the decoder or read adjacent memory into the decoded output.","audience":"developers","category":"package","nicknames":[],"who_cares":["libaec","hdf5","szip","scientific-computing"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Decoder crashes or leaks adjacent memory into decoded samples","analyst_note":"Confirm the fixed libaec version from the release notes at github.com and whether the advisory on vulncheck.com names a fix.","how_to_check":"- Check the installed libaec version with `aec_version` or your package manager, and compare against the affected range through 1.1.7\n- Search your dependency manifests and vendored code for `libaec` or `libsz` to find where it is used\n- Confirm whether your application decodes untrusted SZIP/CCSDS-compressed input","plain_action":"","needs_analyst":true,"not_affected_if":["no-szip-decoding","trusted-input-only"],"who_is_affected":"Applications that decode CCSDS 121.0 or SZIP compressed data using libaec, typically scientific, satellite or HDF5 tooling. Exposure depends on whether the decoder processes files or streams from sources you do not control; systems decoding only trusted local data are lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4203,"output_tokens":646,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120457':16A,19A '-2026':15A,18A '/szip':37B,118C '1.1.7':82C '121.0':36B,117C '2':121C '31':122C 'adjac':74B,133C 'allow':98C 'attack':62B,99C,111C 'bit':60B,126C 'bound':5A,43B,88C,104C 'bypass':101C 'ccsds':35B,116C 'check':105C 'compress':29B 'comput':25B 'contain':83C 'craft':51B,115C 'crash':10A,69B,128C 'cve':14A,17A 'data':33B 'decod':8A,47B,71B,78B,94C,130C,136C 'file':67B 'format':34B 'fundament':109C 'given':49B 'hdf5':20B 'leak':12A,132C 'libaec':1A,21B,27B,80C 'librari':30B 'long':56B 'm':92C 'memori':13A,75B,134C 'out-of-bound':2A,40B,85C 'output':79B 'overlong':108C 'packag':22B 'read':6A,44B,73B,89C 'run':57B 'sampl':137C 'scientif':24B,32B 'scientific-comput':23B 'se':93C 'sequenc':110C 'sign':103C 'src/decode.c':96C 'stream':52B,119C 'suppli':64B,113C 'szip':26B 'via':106C 'vulner':90C 'zero':59B,125C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode CCSDS 121.0 or SZIP compressed data using libaec, typically scientific, satellite or HDF5 tooling. Exposure depends on whether the decoder processes files or streams from sources you do not control; systems decoding only trusted local data are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hdf5","libaec","medium","package","scientificcomputing","szip"],"first_public_at":"2026-11-02T15:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120457","severity":null,"published_at":"2026-11-02T15:17:29+00:00","modified_at":"2026-11-02T15:17:29+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","fetched_at":"2026-11-02T15:24:03+00:00","note":null}],"documents":[{"id":52511,"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/releases/tag/v1.1.7","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52512,"url":"https://www.vulncheck.com/advisories/libaec-through-1.1.7-out-of-bounds-read-via-m-se-decode-second-extension-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}