CVE-2026-75615

MEDIUM 5.3

ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.

CWE	CWE-125 CWE-129
Vendor	esa
Product	asn1scc
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for esa asn1scc

Be the first to know when new medium vulnerabilities affecting esa asn1scc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

esa / asn1scc

< 4.7.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8 github.com: https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9 github.com: https://github.com/esa/asn1scc/releases/tag/4.7.0.1