{"id":"CVE-2026-62298","kind":"vulnerability","aliases":["CVE-2026-62298"],"related":[],"title":"asn1c: OPEN TYPE decoding crashes program on unallocated member","description":"mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get` in `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber_get` in `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer_get` in `OPEN_TYPE_oer.c`, and `OPEN_TYPE_uper_get` in `OPEN_TYPE_uper.c` share the pattern: a conditional null check on `*memb_ptr2` resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the `OPEN TYPE` member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for `E2connectionUpdateAcknowledge`, notes that `E2AP` uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.","summary":"The asn1c ASN.1 compiler's generated decoders for OPEN TYPE members dereference a pointer that may be unallocated, causing a segmentation fault. An attacker who can send a crafted encoded message to a program using the decoder can crash it, which is a denial of service.","severity":"medium","cvss":0.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asn1c","c","e2ap","package","telecom"],"not_affected_if":["no-open-type","trusted-input-only"],"how_to_check":"- Check the asn1c version used to generate the decoder sources in your project, for example with `asn1c -V` or the version recorded in your build files.\n- Look for generated files named `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer.c` or `OPEN_TYPE_uper.c` in your code.\n- Check whether your application decodes untrusted network input with those generated decoders.","fix":"- asn1c: `1.2.5`","status":"open","published_at":"2026-10-30T19:18:33+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:27:51+00:00","updated_at":"2026-10-30T19:27:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T19:27:51Z","model":"claude-haiku-5-5","output":{"fix":"- asn1c: `1.2.5`","reach":"network","title":"asn1c: OPEN TYPE decoding crashes program on unallocated member","impact":"low","summary":"The asn1c ASN.1 compiler's generated decoders for OPEN TYPE members dereference a pointer that may be unallocated, causing a segmentation fault. An attacker who can send a crafted encoded message to a program using the decoder can crash it, which is a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["asn1c","c","telecom","e2ap"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Consuming program crashes with a segmentation fault on malicious input","analyst_note":"","how_to_check":"- Check the asn1c version used to generate the decoder sources in your project, for example with `asn1c -V` or the version recorded in your build files.\n- Look for generated files named `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer.c` or `OPEN_TYPE_uper.c` in your code.\n- Check whether your application decodes untrusted network input with those generated decoders.","plain_action":"","needs_analyst":false,"not_affected_if":["no-open-type","trusted-input-only"],"who_is_affected":"Programs that use asn1c-generated code to decode ASN.1 messages with OPEN TYPE members, particularly when the input comes from untrusted sources such as telecom protocols (the sources cite E2AP, which uses APER). Projects that only encode data, or that do not use OPEN TYPE, are less exposed. The sources do not say which exact applications are affected beyond this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4413,"output_tokens":636,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62298':12A,15A '1.2.5':74C,207C 'advisori':176C 'affect':200C 'alloc':162C 'also':196C 'aper':91C,180C,188C 'aper.c':96C 'arithmet':167C 'asn.1':23B,70C 'asn1c':1A,16B,22B 'attack':44B 'ber':99C,192C 'ber.c':104C 'c':17B 'caus':39B,171C 'check':128C 'compil':24B,71C 'comput':143C 'condit':126C 'consum':87C 'craft':49B 'crash':5A,59B,85C,181C 'cve':10A,13A 'decod':4A,27B,57B,77C 'demonstr':177C 'denial':64B 'derefer':32B,79C 'e2ap':18B,186C 'e2connectionupdateacknowledge':183C 'encod':50B 'execut':140C 'exist':138C 'explicit':197C 'fault':42B,174C 'fix':204C 'generat':26B 'get':92C,100C,108C,117C 'identifi':198C 'inner':145C 'issu':202C 'may':36B 'memb':130C 'member':9A,31B,82C,137C,152C,158C 'messag':51B 'mouse07410/asn1c':67C 'note':184C 'null':127C,165C 'null-point':164C 'oer':107C,194C 'oer.c':112C 'offset':153C 'open':2A,29B,75C,89C,94C,97C,102C,105C,110C,114C,119C,156C 'packag':19B 'pattern':124C 'pointer':34B,83C,149C,166C 'presenc':133C 'prior':72C 'program':6A,54B,88C 'provid':190C 'ptr2':131C 'read':170C 'reproduc':193C 'reset':132C 'segment':41B,173C 'send':47B 'servic':66B 'share':122C 'subsequ':169C 'telecom':20B 'type':3A,30B,76C,90C,95C,98C,103C,106C,111C,115C,120C,157C 'unalloc':8A,38B,81C 'uncondit':142C 'uper':116C,178C 'uper.c':121C 'use':55B,187C 'valu':146C 'version':206C","nicknames":[],"mitigations":[],"who_affected":"Programs that use asn1c-generated code to decode ASN.1 messages with OPEN TYPE members, particularly when the input comes from untrusted sources such as telecom protocols (the sources cite E2AP, which uses APER). Projects that only encode data, or that do not use OPEN TYPE, are less exposed. The sources do not say which exact applications are affected beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T19:18:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62298","severity":null,"published_at":"2026-10-30T19:18:33+00:00","modified_at":"2026-10-30T19:18:33+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}