Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-76077ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()

High 8.1

In plain English

A high-severity buffer overflow in asn1scc from esa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 67.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.

Affected products (as reported)

Vendor	Product	Versions
esa	asn1scc	< 4.7.0.1

Weakness: CWE-120, CWE-125, CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9 x_refsource_CONFIRM
https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9 x_refsource_MISC
https://github.com/esa/asn1scc/releases/tag/4.7.0.1 x_refsource_MISC