CVE-2026-62298: falha em mouse07410 asn1c
asn1c: ASAN crash with decode of open types
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 0epss 0.5%
mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get` in `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber_get` in `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer_get` in `OPEN_TYPE_oer.c`, and `OPEN_TYPE_uper_get` in `OPEN_TYPE_uper.c` share the pattern: a conditional null check on `*memb_ptr2` resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the `OPEN TYPE` member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for `E2connectionUpdateAcknowledge`, notes that `E2AP` uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
mouse07410 · asn1cCVEs relacionadas — mouse07410 asn1c
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/mouse07410/asn1c/commit/3f7d3bbac8cd195d552945e79586ca5000f33280https://github.com/mouse07410/asn1c/commit/71ae41bd1cb146a432a39f72010b48f45ad69463https://github.com/mouse07410/asn1c/releases/tag/v1.2.5https://github.com/mouse07410/asn1c/security/advisories/GHSA-rcj5-gcvg-x796