Live › vulnerability › CVE-2026-62298
The asn1c ASN.1 compiler's generated decoders for OPEN TYPE members dereference a pointer that may be unallocated, causing a segmentation fault. An attacker who can send a crafted encoded message to a program using the decoder can crash it, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Programs that use asn1c-generated code to decode ASN.1 messages with OPEN TYPE members, particularly when the input comes from untrusted sources such as telecom protocols (the sources cite E2AP, which uses APER). Projects that only encode data, or that do not use OPEN TYPE, are less exposed. The sources do not say which exact applications are affected beyond this.
No product ranges from the sources yet.
asn1c -V or the version recorded in your build files.OPEN_TYPE_aper.c, OPEN_TYPE_ber.c, OPEN_TYPE_oer.c or OPEN_TYPE_uper.c in your code.1.2.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, OPEN TYPE decoding can dereference an unallocated member pointer and crash the consuming program. OPEN_TYPE_aper_get in OPEN_TYPE_aper.c, OPEN_TYPE_ber_get in OPEN_TYPE_ber.c, OPEN_TYPE_oer_get in OPEN_TYPE_oer.c, and OPEN_TYPE_uper_get in OPEN_TYPE_uper.c share the pattern: a conditional null check on *memb_ptr2 resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the OPEN TYPE member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for E2connectionUpdateAcknowledge, notes that E2AP uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-62298")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.