String Decoding Issue in ASN1SCC Open Source Compiler
CVE-2026-75615

5.3MEDIUM

Key Information:

Vendor

Esa

Status
Asn1scc
Vendor
CVE Published:
5 November 2026

What is CVE-2026-75615?

The ASN1SCC open source compiler for embedded systems suffers from an improper input validation vulnerability. Before version 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private and the generated decoder InternalItem_string_with_alpha_decode fail to validate decoded character indexes against the allowed character set. This flaw may allow an attacker to craft a message that selects an incorrect encoded index. If exploited, this may enable unauthorized reading of static program constants adjacent to valid entries, potentially leaking sensitive data. This issue is resolved in version 4.7.0.1.

Affected Version(s)

asn1scc < 4.7.0.1

References

https://github.com/esa/asn1scc/security/advisories/GHSA-2...
x_refsource_CONFIRM
https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def...
x_refsource_MISC
https://github.com/esa/asn1scc/releases/tag/4.7.0.1
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.