ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)
asn1scc before 4.7.0.1 is affected when its generated uPER or ACN decoders handle types with variable-size fields and constrained ranges where range + 1 is not a power of two. Fixed in 4.7.0.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- Fixed in 4.7.0.1
- Who is exposed
- Default setups
Do first: Check every install: default setups are affected.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 46/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
ASN1SCC, an open source ASN.1 compiler used for embedded systems, has an out-of-bounds write flaw in its generated uPER and ACN decoders that can be reached remotely, without logging in, by sending crafted data that the decoder processes. An attacker who succeeds can corrupt heap or stack memory, which may crash the software or potentially allow code execution.
Read the original description
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.
cve.now Index
- Exploitation15/40CISA rates a proof of concept as public
- Exposure22/25Default setups, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity9.1/10CVSS 8.1, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
What to do
Check every install: default setups are affected.
Upgrade to a fixed version: 4.7.0.1.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- esa asn1scc
fixed in 4.7.0.1
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-75614
Is CVE-2026-75614 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The generated decoder writes past the bounds of its buffer when decoding a constrained whole number in uPER or ACN data. This out-of-bounds write can corrupt heap or stack memory.Source: github.com
Which versions are affected by CVE-2026-75614?
asn1scc: before 4.7.0.1.Source: cve.now feed data
Am I affected, and how do I check?
asn1scc versions before 4.7.0.1 are affected. The bug needs a generated uPER or ACN decoder for a type with a variable-size field (SEQUENCE OF, OCTET STRING, BIT STRING, or variable-length string) and a constrained range where range + 1 is not a power of two. Check the asn1scc version used to generate the decoder and whether the generated types match these conditions.Source: github.com
How do I fix CVE-2026-75614?
Upgrade asn1scc to 4.7.0.1 or later, which contains the fix in commit fe6ab763bc60d8a2def4104c15414809b45fffd9. Then regenerate the uPER or ACN decoders.Source: github.com