Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-75615ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders

Medium 5.3

In plain English

A medium-severity out-of-bounds read in asn1scc from esa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 85.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.

Affected products (as reported)

Vendor	Product	Versions
esa	asn1scc	< 4.7.0.1

Weakness: CWE-125, CWE-129 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8 x_refsource_CONFIRM
https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9 x_refsource_MISC
https://github.com/esa/asn1scc/releases/tag/4.7.0.1 x_refsource_MISC