---
id: "CVE-2026-75614"
kind: "vulnerability"
aliases: ["CVE-2026-75614"]
title: "ASN1SCC: crafted ASN.1 input can overflow decoder buffers and corrupt memory"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asn.1", "asn1scc", "embedded", "package"]
not_affected_if: ["no-generated-uper-or-acn-decoders", "trusted-input-only"]
published_at: "2026-11-05T17:18:20+00:00"
first_seen_at: "2026-11-05T17:40:05+00:00"
updated_at: "2026-11-05T17:42:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75614", "first_seen_at": "2026-11-05T17:40:05+00:00"}]
exploit_sources: []
---

# ASN1SCC: crafted ASN.1 input can overflow decoder buffers and corrupt memory

ASN1SCC is an open source ASN.1 compiler whose generated uPER and ACN decoders accept out-of-range size fields for constrained integers. A crafted over-range size can write past a destination buffer, which can corrupt memory, crash the decoder, or potentially allow code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ASN1SCC version; releases before `4.7.0.1` are affected.
- Look for generated uPER or ACN decoder code in your build, and check whether it decodes untrusted input.

## Fix

- ASN1SCC: upgrade to `4.7.0.1`

## Timeline

- 2026-11-05T17:40:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-75614

## Documents

- [advisory] Vendor advisory: github.com https://github.com/esa/asn1scc/security/advisories/GHSA-825c-7h77-2jjq
- [fix] Patch: github.com https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9
- [fix] Release notes: github.com https://github.com/esa/asn1scc/releases/tag/4.7.0.1

## From the sources

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_