Read the docs
TI-2026-85526 Aliases CVE-2026-75615

Out-of-bounds read in ASN1SCC ASN.1 string decoders

Priority LOW 24CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

ASN1SCC before 4.7.0.1 does not validate a decoded character index before reading the allowed character set in its ACN and uPER string decoders (CWE-129). For alphabets whose size is not a power of two, a crafted message can select an unused index and make the decoder return an adjacent static program constant as a valid character. A remote, unauthenticated attacker can send such a message.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.

Why it matters now

EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed asn1scc (esa): 4.7.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
esaasn1sccbefore 4.7.0.14.7.0.1Patch availableCNA
  • asn1scc Vendoresa Affected before 4.7.0.1 Fixed in 4.7.0.1 Patch available CNA

Remediation

Upgrade ASN1SCC to version 4.7.0.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA asn1scc (esa) Fixed in 4.7.0.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-75615
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat

References

Other 3

  • TI-2026-85525 Out-of-bounds write in ASN1SCC decoders for uPER and ACN CVSS 3.1HIGH 8.1
  • TI-2022-12968 The pyesasky for python, as distributed on PyPI, included a code-execution backdoor… CVSS 3.1CRITICAL 9.8
  • TI-2026-85527 Stack buffer overflow in ASN1SCC XER decoder tokenizer CVSS 3.1HIGH 8.1
  • TI-2026-71905 Denial of service in SLE API for Java via unbounded allocation CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences