# CVE-2026-75615: ASN1SCC ACN decoder buffer over-read in string decoding

Source: https://junglewise.ai/threats/cve-2026-75615-asn1scc-is-an-open-source-asn-1-compiler-for-embedded-systems  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-75615 · Severity: medium · CVSS 5.3 · Published 2026-11-05

ASN1SCC is a compiler for ASN.1 data encoding used in embedded systems. A flaw in the ACN decoder fails to validate character indices before accessing lookup tables, allowing a malicious message to read adjacent program memory and return invalid characters as valid. For systems processing untrusted ASN.1 messages, this could leak sensitive data from program constants.

Technologies: [ESA ASN1SCC](https://junglewise.ai/threats/technologies/asn1scc). Vendors: [ESA](https://junglewise.ai/threats/vendors/esa).

## Quick answers

**Is CVE-2026-75615 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75615 being exploited in the wild.

**How severe is CVE-2026-75615?** Medium severity, with a CVSS score of 5.3, published 5 November 2026.

**Which products and versions are affected?** ESA ASN1SCC before 4.7.0.1.

**Is there a fix for CVE-2026-75615?** Yes: fixed in 4.7.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75615 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75615?** Check whether you run ESA ASN1SCC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.7.0.1

## Technical details

The Acn_Dec_String_CharIndex_private function in asn1crt/asn1crt_encoding_acn.c and generated uPER decoders fail to validate a decoded character index before reading the allowedCharSet array. When string alphabets are not power-of-two sized, an attacker can craft a message with an out-of-bounds index that reads a bounded window of adjacent static constants. The 128-character IA5String alphabet is unaffected due to its power-of-two size.

## Affected products

- ESA ASN1SCC before 4.7.0.1

## Timeline

- 2026-11-05: disclosed
- 2026-03-15: patched: Version 4.7.0.1 released

## References

- [https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9](https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9)
- [https://github.com/esa/asn1scc/releases/tag/4.7.0.1](https://github.com/esa/asn1scc/releases/tag/4.7.0.1)

## Related threats

- [ASN1SCC buffer overflow in XER tokenizer](https://junglewise.ai/threats/cve-2026-76077-asn1scc-is-an-open-source-asn-1-compiler-for-embedded-systems)
- [ASN1SCC integer constraint validation bypass in BitStream decoder](https://junglewise.ai/threats/cve-2026-75614-asn1scc-is-an-open-source-asn-1-compiler-for-embedded-systems)