---
id: CVE-2026-120457
title: >-
  libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension
  Decoder
summary: >-
  libaec through 1.1.7 contains an out-of-bounds read vulnerability in
  m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds
  check via an overlong fundamental sequence. Attackers can supply a crafted
  CCSDS 121.0/SZI…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-196
vendor: Deutsches Klimarechenzentrum
product: libaec
affected:
  - libaec <= 1.1.7
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T15:45:31.200283Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T15:46:06.742Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120457'
references:
  - url: 'https://github.com/Deutsches-Klimarechenzentrum/libaec/issues/64'
  - url: 'https://github.com/Deutsches-Klimarechenzentrum/libaec/pull/66'
  - url: >-
      https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.7/src/decode.c#L556-L586
  - url: 'https://github.com/Deutsches-Klimarechenzentrum/libaec/releases/tag/v1.1.7'
    label: libaec v1.1.7 Release Notes
  - url: 'https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read'
  - url: >-
      https://www.vulncheck.com/advisories/libaec-through-1.1.7-out-of-bounds-read-via-m-se-decode-second-extension-decoder
    label: >-
      VulnCheck Advisory: libaec through 1.1.7 Out-of-Bounds Read via
      m_se_decode() Second Extension Decoder
tags:
  - cve.org
  - exploit-available
epss: 0.0024
epssPercentile: 0.15236
ingestedAt: '2026-11-05T19:30:42.695Z'
---

## Overview

libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.

## Affected

- `libaec <= 1.1.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.