---
id: "CVE-2026-75615"
kind: "vulnerability"
aliases: ["CVE-2026-75615"]
title: "ASN1SCC: crafted ASN.1 message leaks adjacent static constants during decoding"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["acn", "asn.1", "asn1scc", "embedded", "package", "uper"]
not_affected_if: ["ia5string-only", "no-acn-or-uper-decoding"]
published_at: "2026-11-05T17:18:20+00:00"
first_seen_at: "2026-11-05T17:40:05+00:00"
updated_at: "2026-11-05T17:42:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75615", "first_seen_at": "2026-11-05T17:40:05+00:00"}]
exploit_sources: []
---

# ASN1SCC: crafted ASN.1 message leaks adjacent static constants during decoding

ASN1SCC is an open source ASN.1 compiler for embedded systems, and versions before 4.7.0.1 fail to validate a decoded character index for string alphabets whose size is not a power of two. A crafted message can make the decoder return a byte read from adjacent static program constants as a successfully decoded character.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ASN1SCC version in the project's dependencies; affected versions are those before `4.7.0.1`.
- Look for ACN or uPER decoding of string types with non-power-of-two alphabets in code generated by ASN1SCC.

## Fix

- ASN1SCC: move to version `4.7.0.1` or later.

## Timeline

- 2026-11-05T17:40:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-75615

## Documents

- [advisory] Vendor advisory: github.com https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8
- [fix] Patch: github.com https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9
- [fix] Release notes: github.com https://github.com/esa/asn1scc/releases/tag/4.7.0.1

## From the sources

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_