{"id":"CVE-2026-75615","kind":"vulnerability","aliases":["CVE-2026-75615"],"related":[],"title":"ASN1SCC: crafted ASN.1 message leaks adjacent static constants during decoding","description":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.","summary":"ASN1SCC is an open source ASN.1 compiler for embedded systems, and versions before 4.7.0.1 fail to validate a decoded character index for string alphabets whose size is not a power of two. A crafted message can make the decoder return a byte read from adjacent static program constants as a successfully decoded character.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acn","asn.1","asn1scc","embedded","package","uper"],"not_affected_if":["ia5string-only","no-acn-or-uper-decoding"],"how_to_check":"- Check the ASN1SCC version in the project's dependencies; affected versions are those before `4.7.0.1`.\n- Look for ACN or uPER decoding of string types with non-power-of-two alphabets in code generated by ASN1SCC.","fix":"- ASN1SCC: move to version `4.7.0.1` or later.","status":"open","published_at":"2026-11-05T17:18:20+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","triaged_at":"2026-11-05T17:42:37+00:00","updated_at":"2026-11-05T17:42:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T17:42:37Z","model":"claude-haiku-5-5","output":{"fix":"- ASN1SCC: move to version `4.7.0.1` or later.","reach":"network","title":"ASN1SCC: crafted ASN.1 message leaks adjacent static constants during decoding","impact":"low","summary":"ASN1SCC is an open source ASN.1 compiler for embedded systems, and versions before 4.7.0.1 fail to validate a decoded character index for string alphabets whose size is not a power of two. A crafted message can make the decoder return a byte read from adjacent static program constants as a successfully decoded character.","audience":"developers","category":"package","nicknames":[],"who_cares":["asn1scc","embedded","asn.1","acn","uper"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker-chosen bytes from static program constants returned as decoded data","analyst_note":"","how_to_check":"- Check the ASN1SCC version in the project's dependencies; affected versions are those before `4.7.0.1`.\n- Look for ACN or uPER decoding of string types with non-power-of-two alphabets in code generated by ASN1SCC.","plain_action":"","needs_analyst":false,"not_affected_if":["ia5string-only","no-acn-or-uper-decoding"],"who_is_affected":"Teams that build embedded or telecom software with ASN1SCC-generated ACN or uPER decoders for string types with non-power-of-two alphabets. The full 128-character IA5String alphabet is not affected, so projects using only that type can skip it. unknown whether other alphabets beyond the one named in the sources are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4401,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-75615':13A,16A '128':163C '4.7.0.1':36B,88C,176C 'acn':17B,90C,93C 'adjac':6A,67B,148C 'affect':169C 'allowedcharset':121C 'alpha':108C 'alphabet':46B,124C,166C 'asn.1':3A,18B,28B,81C 'asn1crt/asn1crt_encoding_acn.c':99C 'asn1scc':1A,19B,23B,76C 'bound':145C 'byte':64B,155C 'charact':42B,75B,117C,160C,164C 'charindex':96C 'compil':29B,82C 'constant':8A,70B,151C 'craft':2A,56B,134C 'cve':11A,14A 'dec':94C 'decod':10A,41B,61B,74B,104C,109C,116C,159C 'embed':20B,31B,84C 'encod':140C 'fail':37B 'fix':173C 'full':162C 'function':92C 'generat':102C 'ia5string':165C 'index':43B,118C,141C 'internalitem':105C 'issu':171C 'leak':5A 'make':59B 'messag':4A,57B,135C 'open':26B,79C 'packag':21B 'power':52B,130C 'prior':86C 'privat':97C 'program':69B,150C 'read':65B,120C,142C 'return':62B,153C 'runtim':91C 'select':137C 'size':48B,126C 'small':144C 'sourc':27B,80C 'static':7A,68B,149C 'stgc/uper_c.stg':111C 'string':45B,95C,106C,123C 'success':73B,158C 'system':32B,85C 'two':54B,132C 'unus':139C 'uper':22B,103C 'valid':39B,114C 'version':34B,175C 'whose':47B,125C 'window':146C","nicknames":[],"mitigations":[],"who_affected":"Teams that build embedded or telecom software with ASN1SCC-generated ACN or uPER decoders for string types with non-power-of-two alphabets. The full 128-character IA5String alphabet is not affected, so projects using only that type can skip it. unknown whether other alphabets beyond the one named in the sources are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["acn","asn1","asn1scc","embedded","medium","package","uper"],"campaign_type":null,"first_public_at":"2026-07-11T11:35:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75615","severity":null,"published_at":"2026-11-05T17:18:20+00:00","modified_at":"2026-11-05T17:18:20+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","fetched_at":"2026-11-05T17:40:05+00:00","note":null}],"documents":[{"id":78128,"url":"https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78129,"url":"https://github.com/esa/asn1scc/releases/tag/4.7.0.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78133,"url":"https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-11T11:35:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}