CVE-2026-75615— ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders

Quick assessment

Affected

esa asn1scc

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ASN1SCC 是一款面向嵌入式系统的开源 ASN.1 编译器。在版本 4.7.0.1 之前，ACN 运行时函数（位于）以及由模板生成的 uPER 解码器函数，在读取之前未对解码后的字符索引进行验证。对于字符集大小不是 2 的幂的字符串字母表，攻击者可构造恶意消息，选择一个未使用的编码索引，从而读取相邻静态程序常量的一小段有界窗口，并将该字节作为成功解码的字符返回。完整的 128 字符 IA5String 字母表不受此问题影响。该问题已在版本 4.7.0.1 中修复。

CVSS 5.3 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders

Source: CVE Program / CVE List V5

Vulnerability Description

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
esa	asn1scc	< 4.7.0.1	-

II. Public POCs for CVE-2026-75615

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-75615

请登录查看更多情报信息。

Other References for CVE-2026-75615 (3)

https://github.com/esa/asn1scc/releases/tag/4.7.0.1 x_refsource_MISC
https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8 x_refsource_CONFIRM
https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-75615

Same Patch Batch · esa · 2026-11-05 · 3 CVEs total

CVE-2026-75614	8.1 HIGH	ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)
CVE-2026-76077	8.1 HIGH	ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()

IV. Related Vulnerabilities

Same product: asn1scc

Same vendor: esa

Same weakness: CWE-125