CVE-2026-120457: falha de média gravidade em Deutsches Klimarechenzentrum libaec
libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.8epss 0.2%
libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Deutsches Klimarechenzentrum · libaecReferências
https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.7/src/decode.c#L556-L586https://github.com/Deutsches-Klimarechenzentrum/libaec/issues/64https://github.com/Deutsches-Klimarechenzentrum/libaec/pull/66https://github.com/Deutsches-Klimarechenzentrum/libaec/releases/tag/v1.1.7https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-readhttps://www.vulncheck.com/advisories/libaec-through-1.1.7-out-of-bounds-read-via-m-se-decode-second-extension-decoder