CVE-2026-76077

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76077", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-18T21:17:32.199Z", "datePublished": "2026-11-05T16:49:58.765Z", "dateUpdated": "2026-11-09T16:50:34.415Z"}, "containers": {"cna": {"title": "ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()", "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "lang": "en", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9"}, {"name": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9", "tags": ["x_refsource_MISC"], "url": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"}, {"name": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1"}], "affected": [{"vendor": "esa", "product": "asn1scc", "versions": [{"version": "< 4.7.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T16:49:58.765Z"}, "descriptions": [{"lang": "en", "value": "ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1."}], "source": {"advisory": "GHSA-38q3-fg5h-wwf9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:12:28.472137Z", "id": "CVE-2026-76077", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:50:34.415Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76077", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T16:12:28.472137Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:12:29.549Z"}}], "cna": {"title": "ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()", "source": {"advisory": "GHSA-38q3-fg5h-wwf9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "esa", "product": "asn1scc", "versions": [{"status": "affected", "version": "< 4.7.0.1"}]}], "references": [{"url": "https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9", "name": "https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9", "name": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1", "name": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T16:49:58.765Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76077", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:50:34.415Z", "dateReserved": "2026-08-18T21:17:32.199Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T16:49:58.765Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "asn1scc", "vendor": "esa", "versions": [{"status": "affected", "version": "< 4.7.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1."}], "id": "CVE-2026-76077", "lastModified": "2026-11-12T20:07:11.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76077", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:12:28.472137Z", "version": "2.0.3"}}]}, "published": "2026-11-05T17:18:20.830", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"}, {"source": "security-advisories@github.com", "url": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "asn1scc: asn1scc: Arbitrary code execution via buffer overflow in XER tokenizer", "id": "2567710", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567710"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["A flaw was found in asn1scc. The XML Encoding Rules (XER) tokenizer does not properly enforce length bounds when copying tag data and fails to check buffer limits during input processing. A remote attacker could exploit this vulnerability by providing a crafted XER message, leading to stack memory corruption or out-of-bounds reads. Successful exploitation could permit arbitrary code execution, disclosure of adjacent memory, or a Denial of Service (DoS) condition by crashing or hanging the decoder."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-76077", "public_date": "2026-11-05T16:49:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76077\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76077\nhttps://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9\nhttps://github.com/esa/asn1scc/releases/tag/4.7.0.1\nhttps://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9"], "statement": "Red Hat rates this vulnerability as Important rather than Critical because, although unauthenticated attackers could trigger stack corruption or service crashes remotely, successful exploitation requires an application to expose XML Encoding Rules (XER) decoding routines to unverified network data. Furthermore, asn1scc is not included in standard Red Hat Enterprise Linux environments, significantly limiting exposure across enterprise deployments. Risk remains confined to specialized workloads that ingest untrusted external ASN.1 XML streams.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.7.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "asn1scc", "source": "cna", "vendor": "esa"}, "product": "asn1scc", "vendor": "esa"}], "created": "2026-11-05T19:00:20.008336+00:00", "updated": "2026-11-06T16:36:12.940420+00:00", "vendors": ["esa", "esa$PRODUCT$asn1scc"]}