CVE-2026-75614 in ASN1SCC
Summary
by MITRE • 11/05/2026
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
ASN1SCC serves as an open-source ASN.1 compiler specifically designed for embedded systems, facilitating the generation of encoding and decoding routines for complex data structures defined by Abstract Syntax Notation One standards. A critical security vulnerability was identified in versions prior to 4.7.0.1 within the BitStream_DecodeConstraintWholeNumber function located in the asn1crt/asn1crt_encoding.c source file. This component is responsible for decoding constrained integers, which are integer values restricted by a specific range defined during compilation. The core technical flaw lies in the logic used to validate these ranges when they are not powers of two. Specifically, while the decoder correctly reads the necessary number of bits from the input stream to reconstruct the integer value, it fails to perform an upper-bound check against the declared maximum limit for that constrained type. This oversight means that if a crafted payload contains a bit sequence representing a value higher than the allowed range but within the capacity of the read buffer, the decoder will accept this invalid result without raising an error or rejecting the input.
The operational impact of this flaw is severe due to how generated decoders for variable-size data structures utilize the decoded integer values. When processing sequences such as SEQUENCE OF, OCTET STRING, BIT STRING, and various string types, the compiler-generated code relies on the decoded length field to determine loop iterations or buffer copy sizes. Because the vulnerability allows an out-of-range value to pass validation unchecked, a malicious actor can craft input data with an oversized size field that exceeds the actual capacity of the destination buffer allocated by the application. When the decoder processes this crafted input, it uses the inflated integer as the length parameter for memory operations. This leads directly to heap or stack-based buffer overflows, where writes extend beyond the boundaries of the intended memory allocation. Such memory corruption can destabilize the application state, leading to crashes and denial of service conditions that disrupt system availability.
Beyond simple instability, this vulnerability presents a significant risk for remote code execution in contexts where untrusted ASN.1 data is processed by embedded systems or network-facing services. By carefully crafting the overflow payload, an attacker may overwrite critical control data such as return addresses or function pointers on the stack, or heap metadata structures like allocation headers and next-pointers. This capability allows for arbitrary memory writes that can facilitate code execution with the privileges of the compromised process. The vulnerability aligns with CWE-190 Integer Overflow Wraparound in terms of logic failure to constrain values, but more accurately maps to CWE-787 Out-of-bounds Write due to improper validation leading to buffer overflow conditions. In the context of attack patterns, this flaw can be leveraged within techniques associated with ATT&CK T1203 Exploitation for Client Execution or T1059 Command and Scripting Interpreter if the resulting code execution is used to run further payloads on the embedded device.
The recommended mitigation strategy involves upgrading ASN1SCC to version 4.7.0.1 or later, where this validation logic has been corrected to properly reject values that exceed the declared range for constrained integers. For organizations unable to immediately update their compiler toolchain, defensive programming practices should be implemented within custom decoding wrappers. These include explicit bounds checking on all decoded length fields before they are used in memory allocation or copy operations, ensuring that any value derived from untrusted ASN.1 data is validated against the maximum expected size for the target buffer. Additionally, employing static analysis tools configured to detect potential out-of-bounds writes and runtime protection mechanisms such as stack canaries and heap hardening features can help mitigate the exploitation of this class of vulnerabilities in legacy systems that remain vulnerable until a full patch cycle is completed.