CVE-2026-75615 · Package
NO FIX YET · SEE WHAT TO DO
ASN1SCC is an open source ASN.1 compiler for embedded systems, and versions before 4.7.0.1 fail to validate a decoded character index for string alphabets whose size is not a power of two. A crafted message can make the decoder return a byte read from adjacent static program constants as a successfully decoded character.
first public Jul 11, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that build embedded or telecom software with ASN1SCC-generated ACN or uPER decoders for string types with non-power-of-two alphabets. The full 128-character IA5String alphabet is not affected, so projects using only that type can skip it. unknown whether other alphabets beyond the one named in the sources are affected.
Not affected if ia5string-only, no-acn-or-uper-decoding
Who cares acn, asn.1, asn1scc, embedded, uper
4.7.0.1.4.7.0.1 or later.ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.