{"affected":[{"product":"asn1scc","source":"CNA: GitHub_M","vendor":"esa","versions":[{"status":"affected","version":"< 4.7.0.1"}]}],"cveId":"CVE-2026-75614","cwes":["CWE-129","CWE-787"],"description":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.","epss":null,"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/esa/asn1scc/security/advisories/GHSA-825c-7h77-2jjq"}],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793903161514,"publishedAt":1793897276986,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/esa/asn1scc/security/advisories/GHSA-825c-7h77-2jjq"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/esa/asn1scc/releases/tag/4.7.0.1"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/esa/asn1scc/security/advisories/GHSA-825c-7h77-2jjq"}],"remediation":[],"revision":"2985b48e729b45157bd0d74f2eb8db6dc34433b6d1df42991276ad79b87ad95e","sources":[{"modifiedAt":1793903161514,"name":"CNA: GitHub_M","retrievedAt":1793905848028,"url":"https://www.cve.org/CVERecord?id=CVE-2026-75614"}],"ssvc":{"assessedAt":1793903112643,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)","updatedAt":1793905848028}