CVE-2026-62298

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, OPEN TYPE decoding can dereference an unallocated member pointer and crash the consuming program. OPEN_TYPE_aper_get in OPEN_TYPE_aper.c, OPEN_TYPE_ber_get in OPEN_TYPE_ber.c, OPEN_TYPE_oer_get in OPEN_TYPE_oer.c, and OPEN_TYPE_uper_get in OPEN_TYPE_uper.c share the pattern: a conditional null check on *memb_ptr2 resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the OPEN TYPE member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for E2connectionUpdateAcknowledge, notes that E2AP uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, OPEN TYPE decoding can dereference an unallocated member pointer and crash the consuming program. OPEN_TYPE_aper_get in OPEN_TYPE_aper.c, OPEN_TYPE_ber_get in OPEN_TYPE_ber.c, OPEN_TYPE_oer_get in OPEN_TYPE_oer.c, and OPEN_TYPE_uper_get in OPEN_TYPE_uper.c share the pattern: a conditional null check on *memb_ptr2 resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the OPEN TYPE member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for E2connectionUpdateAcknowledge, notes that E2AP uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, OPEN TYPE decoding can dereference an unallocated member pointer and crash the consuming program. OPEN_TYPE_aper_get in OPEN_TYPE_aper.c, OPEN_TYPE_ber_get in OPEN_TYPE_ber.c, OPEN_TYPE_oer_get in OPEN_TYPE_oer.c, and OPEN_TYPE_uper_get in OPEN_TYPE_uper.c share the pattern: a conditional null check on *memb_ptr2 resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the OPEN TYPE member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for E2connectionUpdateAcknowledge, notes that E2AP uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, OPEN TYPE decoding can dereference an unallocated member pointer and crash the consuming program. OPEN_TYPE_aper_get in OPEN_TYPE_aper.c, OPEN_TYPE_ber_get in OPEN_TYPE_ber.c, OPEN_TYPE_oer_get in OPEN_TYPE_oer.c, and OPEN_TYPE_uper_get in OPEN_TYPE_uper.c share the pattern: a conditional null check on *memb_ptr2 resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the OPEN TYPE member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for E2connectionUpdateAcknowledge, notes that E2AP uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.