Buffer Overflow Vulnerability in ASN.1 Compiler for Embedded Systems
CVE-2026-76077

8.1HIGH

Key Information:

Vendor

Esa

Status
Asn1scc
Vendor
CVE Published:
5 November 2026

What is CVE-2026-76077?

The ASN1SCC open-source ASN.1 compiler for embedded systems contains a buffer overflow vulnerability related to the XER tokenizer. When processing XER encoded messages, the tokenizer does not properly manage the size of its fixed-length buffer, allowing for potential stack frame overwrites from crafted messages with overlong tags. Additionally, issues arise from truncated tags or unterminated sequences that can lead to reading beyond input boundaries. These flaws may result in memory disclosure, stack data corruption, and could crash or hang the decoder, with the potential for code execution. This vulnerability has been patched in version 4.7.0.1.

Affected Version(s)

asn1scc < 4.7.0.1

References

https://github.com/esa/asn1scc/security/advisories/GHSA-3...
x_refsource_CONFIRM
https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def...
x_refsource_MISC
https://github.com/esa/asn1scc/releases/tag/4.7.0.1
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.