Executive brief
asn1c is a tool used to generate code for processing complex network protocols, commonly found in 5G telecommunications, automotive (V2X) communications, and digital certificates. A flaw in how it handles certain types of data allows a remote attacker to send a specially crafted message that crashes the receiving application. This can lead to a total service outage (Denial of Service) or cause the system to process data incorrectly, potentially bypassing security logic in critical infrastructure.
Technical details
A heap out-of-bounds (OOB) read exists in the OER (Octet Encoding Rules) decoding skeleton files, specifically within 'INTEGER_oer.c'. The vulnerability is triggered when the decoder processes a variable-length, non-negative INTEGER type with a maliciously crafted zero-length payload. The root cause is a failure to validate 'req_bytes' before dereferencing 'ptr' to extract the Most Significant Bit (MSB). An attacker can exploit this by sending a 0x00 length determinant, which may result in a segmentation fault (DoS) if the read crosses a memory page boundary, or 'protocol state poisoning' if the OOB bit is incorrectly interpreted as valid data. This affects code generated by both the original 'vlm/asn1c' and the 'mouse07410/asn1c' fork.
Affected products
- mouse07410 asn1c <= 1.4
- vlm asn1c <= 0.9.28
Timeline
- 2026-05-11: advisory: GitHub security advisory published by mouse07410
- 2026-05-29: disclosed: CVE-2026-45615 published to NVD