CVE-2026-75614 · Package
NO FIX YET · SEE WHAT TO DO
ASN1SCC is an open source ASN.1 compiler whose generated uPER and ACN decoders accept out-of-range size fields for constrained integers. A crafted over-range size can write past a destination buffer, which can corrupt memory, crash the decoder, or potentially allow code execution.
first public Jul 11, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that use the ASN1SCC compiler to generate uPER or ACN decoders and feed them data from untrusted sources, typically embedded systems and protocol stacks. Projects that only use ASN1SCC on trusted data, or that do not run generated decoders on external input, are less exposed.
Not affected if no-generated-uper-or-acn-decoders, trusted-input-only
Who cares asn.1, asn1scc, embedded
4.7.0.1 are affected.4.7.0.1ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.