Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-75615 Details

Description

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9	[email protected]
https://github.com/esa/asn1scc/releases/tag/4.7.0.1	[email protected]
https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-125	Out-of-bounds Read	[email protected]
CWE-129	Improper Validation of Array Index	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes