{"id":"CVE-2026-75614","kind":"vulnerability","aliases":["CVE-2026-75614"],"related":[],"title":"ASN1SCC: crafted ASN.1 input can overflow decoder buffers and corrupt memory","description":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.","summary":"ASN1SCC is an open source ASN.1 compiler whose generated uPER and ACN decoders accept out-of-range size fields for constrained integers. A crafted over-range size can write past a destination buffer, which can corrupt memory, crash the decoder, or potentially allow code execution.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asn.1","asn1scc","embedded","package"],"not_affected_if":["no-generated-uper-or-acn-decoders","trusted-input-only"],"how_to_check":"- Check the installed ASN1SCC version; releases before `4.7.0.1` are affected.\n- Look for generated uPER or ACN decoder code in your build, and check whether it decodes untrusted input.","fix":"- ASN1SCC: upgrade to `4.7.0.1`","status":"open","published_at":"2026-11-05T17:18:20+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","triaged_at":"2026-11-05T17:42:16+00:00","updated_at":"2026-11-05T17:42:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T17:42:16Z","model":"claude-haiku-5-5","output":{"fix":"- ASN1SCC: upgrade to `4.7.0.1`","reach":"unknown","title":"ASN1SCC: crafted ASN.1 input can overflow decoder buffers and corrupt memory","impact":"high","summary":"ASN1SCC is an open source ASN.1 compiler whose generated uPER and ACN decoders accept out-of-range size fields for constrained integers. A crafted over-range size can write past a destination buffer, which can corrupt memory, crash the decoder, or potentially allow code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["asn1scc","embedded","asn.1"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Decoding crafted input corrupts heap or stack memory, possibly running code","analyst_note":"","how_to_check":"- Check the installed ASN1SCC version; releases before `4.7.0.1` are affected.\n- Look for generated uPER or ACN decoder code in your build, and check whether it decodes untrusted input.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","no-generated-uper-or-acn-decoders"],"who_is_affected":"Teams that use the ASN1SCC compiler to generate uPER or ACN decoders and feed them data from untrusted sources, typically embedded systems and protocol stacks. Projects that only use ASN1SCC on trusted data, or that do not run generated decoders on external input, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4410,"output_tokens":563,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-75614':14A,17A '4.7.0.1':81C,178C 'accept':35B 'acn':33B,115C 'affect':156C 'allow':66B 'asn.1':3A,18B,27B,74C 'asn1crt/asn1crt_encoding.c':85C 'asn1scc':1A,19B,22B,69C 'beyond':150C 'bit':88C,125C 'bitstream':82C 'buffer':8A,56B,153C 'caus':164C 'code':67B,170C 'compil':28B,75C 'constrain':43B,91C 'copi':138C 'corrupt':10A,59B,159C 'craft':2A,46B,142C 'crash':61B,166C 'cve':12A,15A 'data':157C 'declar':100C 'decod':7A,34B,63B,116C,154C 'decodeconstraintwholenumb':83C 'destin':55B,152C 'embed':20B,77C 'encod':104C 'enough':87C 'execut':68B,171C 'field':41B,147C 'fix':175C 'generat':30B,112C 'heap':160C 'input':4A 'integ':44B,92C 'invalid':132C 'issu':173C 'length':139C 'loop':136C 'memori':11A,60B,163C 'octet':123C 'open':25B,72C 'out-of-rang':36B 'over-rang':47B,143C 'overflow':6A 'packag':21B 'past':53B 'permit':169C 'potenti':65B,168C 'power':109C 'prior':79C 'rang':39B,49B,101C,105C,145C 'read':86C 'reject':96C 'result':133C 'sequenc':121C 'size':40B,50B,120C,146C 'sourc':26B,73C 'stack':162C 'string':124C,126C,128C 'system':78C 'two':111C 'untrust':155C 'uper':31B,113C 'use':130C 'valu':97C,129C 'variabl':119C 'variable-s':118C 'version':177C 'whose':29B 'write':52B,149C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the ASN1SCC compiler to generate uPER or ACN decoders and feed them data from untrusted sources, typically embedded systems and protocol stacks. Projects that only use ASN1SCC on trusted data, or that do not run generated decoders on external input, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["asn1","asn1scc","embedded","high","package"],"campaign_type":null,"first_public_at":"2026-07-11T11:35:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75614","severity":null,"published_at":"2026-11-05T17:18:20+00:00","modified_at":"2026-11-05T17:18:20+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","fetched_at":"2026-11-05T17:40:05+00:00","note":null}],"documents":[{"id":78128,"url":"https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78129,"url":"https://github.com/esa/asn1scc/releases/tag/4.7.0.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78130,"url":"https://github.com/esa/asn1scc/security/advisories/GHSA-825c-7h77-2jjq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-11T11:35:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}