CVE-2026-75615

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75615", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-17T23:49:03.451Z", "datePublished": "2026-11-05T16:49:20.422Z", "dateUpdated": "2026-11-09T22:21:47.449Z"}, "containers": {"cna": {"title": "ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8"}, {"name": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9", "tags": ["x_refsource_MISC"], "url": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"}, {"name": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1"}], "affected": [{"vendor": "esa", "product": "asn1scc", "versions": [{"version": "< 4.7.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T16:49:20.422Z"}, "descriptions": [{"lang": "en", "value": "ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1."}], "source": {"advisory": "GHSA-234q-m7gr-pcf8", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T22:21:21.828180Z", "id": "CVE-2026-75615", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:21:47.449Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75615", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-17T23:49:03.451Z", "datePublished": "2026-11-05T16:49:20.422Z", "dateUpdated": "2026-11-09T22:21:47.449Z"}, "containers": {"cna": {"title": "ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8"}, {"name": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9", "tags": ["x_refsource_MISC"], "url": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"}, {"name": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1"}], "affected": [{"vendor": "esa", "product": "asn1scc", "versions": [{"version": "< 4.7.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T16:49:20.422Z"}, "descriptions": [{"lang": "en", "value": "ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1."}], "source": {"advisory": "GHSA-234q-m7gr-pcf8", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-75615", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T22:21:21.828180Z"}}}], "references": [{"url": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:21:42.838Z"}}]}}

{"affected": [{"affectedData": [{"product": "asn1scc", "vendor": "esa", "versions": [{"status": "affected", "version": "< 4.7.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1."}], "id": "CVE-2026-75615", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75615", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T22:21:21.828180Z", "version": "2.0.3"}}]}, "published": "2026-11-05T17:18:20.663", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"}, {"source": "security-advisories@github.com", "url": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-129"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "asn1scc: ASN1SCC: Information disclosure via out-of-bounds read during string decoding", "id": "2567840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567840"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in ASN1SCC. The runtime and generated string decoders fail to properly validate decoded character indices against the allowed character set before memory access. A remote attacker could exploit this vulnerability by sending a specially crafted message, triggering an out-of-bounds read of adjacent static program memory and leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-75615", "public_date": "2026-11-05T16:49:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-75615\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-75615\nhttps://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9\nhttps://github.com/esa/asn1scc/releases/tag/4.7.0.1\nhttps://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8"], "statement": "This vulnerability is rated as having a Moderate impact because the flaw permits an unauthenticated remote attacker to trigger an out-of-bounds read, but the resulting leak is strictly restricted to a small, adjacent segment of static program memory constants rather than sensitive runtime memory or system execution control. Furthermore, standard full alphabets such as IA5String are not impacted, narrowing the scope to schemas utilizing non-power-of-two custom character sets. Red Hat Enterprise Linux does not include ASN1SCC, minimizing exposure across Red Hat environments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.7.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "asn1scc", "source": "cna", "vendor": "esa"}, "product": "asn1scc", "vendor": "esa"}], "created": "2026-11-05T19:00:20.009111+00:00", "updated": "2026-11-06T16:36:16.655158+00:00", "vendors": ["esa", "esa$PRODUCT$asn1scc"]}