Read the docs
TI-2026-85527 Aliases CVE-2026-76077

Stack buffer overflow in ASN1SCC XER decoder tokenizer

Priority LOW 35CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

ASN1SCC, an open source ASN.1 compiler for embedded systems, is affected before 4.7.0.1. The XER tokenizer NT() copies tag characters into a fixed Value[100] field without a length bound (CWE-120) and reads input without checking the buffer count. A remote attacker without privileges or user interaction can send a crafted XER message with an overlong tag to overwrite stack data, read adjacent memory, or crash or hang the decoder, and code execution may be possible.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.

Why it matters now

EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed asn1scc (esa): 4.7.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
esaasn1sccbefore 4.7.0.14.7.0.1Patch availableCNA
  • asn1scc Vendoresa Affected before 4.7.0.1 Fixed in 4.7.0.1 Patch available CNA

Remediation

Upgrade asn1scc to version 4.7.0.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA asn1scc (esa) Fixed in 4.7.0.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-76077
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-85525 Out-of-bounds write in ASN1SCC decoders for uPER and ACN CVSS 3.1HIGH 8.1
  • TI-2022-12968 The pyesasky for python, as distributed on PyPI, included a code-execution backdoor… CVSS 3.1CRITICAL 9.8
  • TI-2026-71905 Denial of service in SLE API for Java via unbounded allocation CVSS 3.1MEDIUM 5.3
  • TI-2026-85526 Out-of-bounds read in ASN1SCC ASN.1 string decoders CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences