Out-of-bounds Read Vulnerability in libaec Affects Decoder Functionality
CVE-2026-120457
5.8MEDIUM
What is CVE-2026-120457?
The vulnerability in libaec allows attackers to exploit m_se_decode() in src/decode.c, leading to an out-of-bounds read. By crafting a CCSDS 121.0/SZIP stream featuring 2^31 or more zero bits, an attacker can bypass signed bounds checks. This can result in a crash of the decoder or a leak of adjacent memory, potentially exposing sensitive data.
Affected Version(s)
libaec 0 <= 1.1.7
References
CVSS V4
Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology