{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-76077","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-08-18T21:17:32.199Z","datePublished":"2026-11-05T16:49:58.765Z","dateUpdated":"2026-11-05T16:49:58.765Z"},"containers":{"cna":{"title":"ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()","problemTypes":[{"descriptions":[{"cweId":"CWE-120","lang":"en","description":"CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-125","lang":"en","description":"CWE-125: Out-of-bounds Read","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-787","lang":"en","description":"CWE-787: Out-of-bounds Write","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"name":"https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9","tags":["x_refsource_CONFIRM"],"url":"https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9"},{"name":"https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9","tags":["x_refsource_MISC"],"url":"https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"},{"name":"https://github.com/esa/asn1scc/releases/tag/4.7.0.1","tags":["x_refsource_MISC"],"url":"https://github.com/esa/asn1scc/releases/tag/4.7.0.1"}],"affected":[{"vendor":"esa","product":"asn1scc","versions":[{"version":"< 4.7.0.1","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-05T16:49:58.765Z"},"descriptions":[{"lang":"en","value":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1."}],"source":{"advisory":"GHSA-38q3-fg5h-wwf9","discovery":"UNKNOWN"}}}}