CVE-2026-75614High· 8.1▾ MidnightPoC availableASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declare…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.
asn1scc < 4.7.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75615Medium· 5.3ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders
CVE-2026-76077High· 8.1ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()
CVE-2026-109250Medium· 6.6FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration
CVE-2026-116783High· 8.2FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data
CVE-2026-107457Low· 2.3Memory corruption vulnerability in QMqttClient impacts Qt MQTT
CVE-2026-93862High· 7.2Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service