Read the docs
TI-2026-85525 Aliases CVE-2026-75614

Out-of-bounds write in ASN1SCC decoders for uPER and ACN

Priority HIGH 70CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-129 and the CVSS impact.

Summary

ASN1SCC, an open source ASN.1 compiler for embedded systems, is affected before 4.7.0.1. BitStream_DecodeConstraintWholeNumber does not reject values above the declared range when the range is not a power of two (CWE-129). Generated uPER and ACN decoders then use the invalid value as a length, so an over-range size field in untrusted data writes past a buffer. Exploitation can corrupt heap or stack memory, cause a crash, or potentially permit code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00582 48th percentileScored 2026-11-07
Fix Fixed asn1scc (esa): 4.7.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
esaasn1sccbefore 4.7.0.14.7.0.1Patch availableCNA
  • asn1scc Vendoresa Affected before 4.7.0.1 Fixed in 4.7.0.1 Patch available CNA

Remediation

Update ASN1SCC to version 4.7.0.1, which fixes this issue. Versions before 4.7.0.1 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA asn1scc (esa) Fixed in 4.7.0.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-75614
  2. 2026-11-05 CISA SSVC decision points changed
  3. 2026-11-05 Priority changed: MEDIUM → HIGH
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 3

  • TI-2022-12968 The pyesasky for python, as distributed on PyPI, included a code-execution backdoor… CVSS 3.1CRITICAL 9.8
  • TI-2026-85527 Stack buffer overflow in ASN1SCC XER decoder tokenizer CVSS 3.1HIGH 8.1
  • TI-2026-71905 Denial of service in SLE API for Java via unbounded allocation CVSS 3.1MEDIUM 5.3
  • TI-2026-85526 Out-of-bounds read in ASN1SCC ASN.1 string decoders CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences