CVE-2026-76077 · Package
NO FIX YET · SEE WHAT TO DO
ASN1SCC is an open source ASN.1 compiler for embedded systems. A crafted XER message with an overlong tag can overwrite the decoder's stack and read past the input, which can leak memory, crash or hang the decoder, and potentially run code.
first public Jul 11, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that compile ASN.1 schemas with ASN1SCC and decode XER-encoded messages, especially embedded systems that accept XER input from outside. Systems that only use other encodings, or never decode untrusted XER, are less exposed.
Not affected if no-xer-decoding, trusted-input-only
Who cares asn1scc, c, embedded, xer
unknown if the project does not record it, otherwise compare against 4.7.0.1.4.7.0.1 or later.ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.