CVE-2026-62298

UnknownCVSS 0.0

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

43th percentile - higher than 43% of all known CVEs

Summary

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get`, `OPEN_TYPE_ber_get`, `OPEN_TYPE_oer_get`, and `OPEN_TYPE_uper_get` share the pattern: a conditional null check on `*memb_ptr2` resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the `OPEN TYPE` member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. This is fixed in version 1.2.5.

Risk Assessment

This may lead to crashes of applications using asn1c to decode ASN.1 data, causing denial of service. The risk affects systems processing untrusted ASN.1 data.

Recommendation

Upgrade asn1c to version 1.2.5 or later. Test applications using OPEN TYPE decoding for vulnerability.

Other vulnerabilities in asn1c

CVE-2026-45615High
In asn1c version 1.4 and earlier, a memory safety vulnerability was found in the generated OER decoding code for INTEGER type. When parsing a maliciously crafted zero-length OER payload for a variable-length non-negative INTEGER, the decoder fails to validate required bytes before extracting the Most Significant Bit, causing a precise 1-byte Heap Out-of-Bounds Read.

Original NVD description (English source)

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get` in `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber_get` in `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer_get` in `OPEN_TYPE_oer.c`, and `OPEN_TYPE_uper_get` in `OPEN_TYPE_uper.c` share the pattern: a conditional null check on `*memb_ptr2` resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the `OPEN TYPE` member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for `E2connectionUpdateAcknowledge`, notes that `E2AP` uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS