# CVE-2026-76077: ASN1SCC buffer overflow in XER tokenizer

Source: https://junglewise.ai/threats/cve-2026-76077-asn1scc-is-an-open-source-asn-1-compiler-for-embedded-systems  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-76077 · Severity: high · CVSS 8.1 · Published 2026-11-05

ASN1SCC is an open-source ASN.1 compiler that generates code for embedded systems to handle structured data formats. A flaw in the XER (XML Encoding Rules) decoder allows an attacker to send a specially crafted message that can crash the decoder, corrupt memory, disclose adjacent data, or potentially execute arbitrary code on systems using vulnerable versions.

Technologies: [ESA ASN1SCC](https://junglewise.ai/threats/technologies/asn1scc). Vendors: [ESA](https://junglewise.ai/threats/vendors/esa).

## Quick answers

**Is CVE-2026-76077 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76077 being exploited in the wild.

**How severe is CVE-2026-76077?** High severity, with a CVSS score of 8.1, published 5 November 2026.

**Which products and versions are affected?** ESA ASN1SCC prior to 4.7.0.1.

**Is there a fix for CVE-2026-76077?** Yes: fixed in 4.7.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76077 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76077?** Check whether you run ESA ASN1SCC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.7.0.1

## Technical details

The XER tokenizer in asn1crt_encoding_xer.c uses a fixed 100-character buffer for tag values without bounds checking, and fails to validate input length before reading lookahead bytes. An overlong tag can overflow the stack buffer; truncated tags or unterminated sequences can read past input bounds. An attacker can craft a malicious XER message over the network (or via any input path to the decoder) to trigger memory corruption, disclosure, or crash.

## Affected products

- ESA ASN1SCC prior to 4.7.0.1

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9](https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9)
- [https://github.com/esa/asn1scc/releases/tag/4.7.0.1](https://github.com/esa/asn1scc/releases/tag/4.7.0.1)

## Related threats

- [ASN1SCC ACN decoder buffer over-read in string decoding](https://junglewise.ai/threats/cve-2026-75615-asn1scc-is-an-open-source-asn-1-compiler-for-embedded-systems)
- [ASN1SCC integer constraint validation bypass in BitStream decoder](https://junglewise.ai/threats/cve-2026-75614-asn1scc-is-an-open-source-asn-1-compiler-for-embedded-systems)