CVE-2026-62298 Details
Description
mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get` in `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber_get` in `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer_get` in `OPEN_TYPE_oer.c`, and `OPEN_TYPE_uper_get` in `OPEN_TYPE_uper.c` share the pattern: a conditional null check on `*memb_ptr2` resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the `OPEN TYPE` member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for `E2connectionUpdateAcknowledge`, notes that `E2AP` uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.
A vulnerability in the Open Type decoding process of the mouse07410/asn1c ASN.1 compiler, prior to version 1.2.5, can lead to a null pointer dereference. This issue occurs in the Open Type decoders for APER, BER, and OER, causing a segmentation fault and crashing the program. The vulnerability arises because the decoders check for the presence of a member pointer but then unconditionally dereference it without ensuring it has been allocated. As a result, if the Open Type member is not allocated, the null pointer arithmetic leads to a crash.
Users can upgrade to asn1c version 1.2.5 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mouse07410/asn1c/commit/3f7d3bbac8cd195d552945e79586ca5000f33280 | [email protected] | Source CodeVendor |
| https://github.com/mouse07410/asn1c/commit/71ae41bd1cb146a432a39f72010b48f45ad69463 | [email protected] | Source CodeVendor |
| https://github.com/mouse07410/asn1c/releases/tag/v1.2.5 | [email protected] | Release NotesVendor |
| https://github.com/mouse07410/asn1c/security/advisories/GHSA-rcj5-gcvg-x796 | [email protected] | AdvisoryExploitRemedyTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mouse07410/asn1c | 405e9530b2fc95e45e1a8c72965c838a110b8ca8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |