{"affected":[{"defaultStatus":"unaffected","product":"libaec","source":"CNA: VulnCheck","vendor":"Deutsches Klimarechenzentrum","versions":[{"lessThanOrEqual":"1.1.7","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120457","cwes":["CWE-196"],"description":"libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.","epss":null,"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read"}],"kev":null,"metrics":[{"score":5.8,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"}],"modifiedAt":1793634366742,"publishedAt":1793629753799,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/issues/64"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/pull/66"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.7/src/decode.c#L556-L586"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/releases/tag/v1.1.7"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/libaec-through-1.1.7-out-of-bounds-read-via-m-se-decode-second-extension-decoder"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read"}],"remediation":[],"revision":"ebf35f6f1ef561854136d5822845768c5bb051ca41eacd7c6736ab2df699e8d8","sources":[{"modifiedAt":1793634366742,"name":"CNA: VulnCheck","retrievedAt":1793635735893,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120457"}],"ssvc":{"assessedAt":1793634331200,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder","updatedAt":1793635735893}