ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…sn1scc/security/advisories/GHSA-825c-7h77-2jjq Diğer
• github.com/…ommit/fe6ab763bc60d8a2def4104c15414809b45fffd9 Diğer
• github.com/esa/asn1scc/releases/tag/4.7.0.1 Diğer

Kayıt geçmişi

1. 5 Kas 2026 19:47Yayımlandı

İlgili açıklar

• 8,1 CVE-2026-76077ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()
• 5,3 CVE-2026-75615ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders
• 5,4 CVE-2026-76181Heap buffer overflow in dBASE index import
• 8,2 CVE-2026-116783FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data
• 5,3 CVE-2026-116781FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing
• 9,1 CVE-2026-116785FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling