{"id":"CVE-2026-76077","aliases":["EUVD-2026-117601","GHSA-38q3-fg5h-wwf9"],"status":"published","title":"ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()","description":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00384,"percentile":0.32798,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120","CWE-125","CWE-787"],"published":"2026-11-05T16:49:58Z","modified":"2026-11-05T21:32:43Z","products":[{"vendor":"esa","product":"asn1scc"}],"references":[{"url":"https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/esa/asn1scc/releases/tag/4.7.0.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76077.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76077","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-76077","title":"ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()","description":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.","status":"published","published":"2026-11-05T16:49:58.765Z","modified":"2026-11-09T16:50:34.415Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-120","CWE-125","CWE-787"],"updated_at":"2026-11-09T17:34:05.709049Z"}],"euvd":[{"id":"EUVD-2026-117601","description":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.","status":"published","published":"2026-11-05T16:49:58Z","modified":"2026-11-09T16:50:34Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T18:17:40.212453Z"}],"nvd":[{"id":"CVE-2026-76077","description":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.","status":"published","published":"2026-11-05T17:18:20.83Z","modified":"2026-11-09T17:17:32.653Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-120","CWE-125","CWE-787"],"updated_at":"2026-11-09T20:15:34.274131Z"}],"osv":[{"id":"CVE-2026-76077","title":"ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()","description":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.","status":"published","published":"2026-11-05T16:49:58.765Z","modified":"2026-11-10T07:05:17.817448792Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-120","CWE-125","CWE-787"],"updated_at":"2026-11-07T03:08:10.477794Z"}]}}