Vulnerability in c (CVE-2026-45615, CVSS 8.2)

Summary

vulnerability in c (CVE-2026-45615). Risk of unauthorized operations or information disclosure. Exploitable via INTEGER_decode_oer.

Original description

The description as published by the source.

mouse07410/asn1c is an ASN.1 compiler. In 1.4 and earlier, a memory safety vulnerability was identified in the OER decoding skeleton files generated by asn1c (specifically INTEGER_oer.c). When parsing a maliciously crafted, zero-length OER payload for a variable-length, non-negative INTEGER type, the decoder fails to validate the required bytes before extracting the Most Significant Bit (MSB). This forces a precise 1-byte Heap Out-of-Bounds (OOB) Read. Because asn1c generated code is primarily deployed to parse untrusted network inputs (such as V2X network protocols, 5G telecom headers, or X.509 certificates), when the decoder processes untrusted network-originated input, a remote attacker can exploit this to cause a Denial of Service (DoS) or trigger incorrect integer interpretation in downstream applications (e.g., protocol state poisoning or logic bypass).

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A vulnerability tracked as CVE-2026-45615 has been found in c.
Attackers can target a specific entry point like INTEGER_decode_oer over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 8.2/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "c CVE-2026-45615" on the vendor's site.

CVE-2026-45615 (c) — CWE-20 / CVSS v3 8.2
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: INTEGER_decode_oer / master / vlm_master / c46e662a39934d3502a4883266b500e21486e736
Affected: <= 1.4
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

OERデコードスケルトンファイル（INTEGER_oer.c）におけるメモリ安全性の脆弱性

📍 Affected scope

バージョン1.4以前のmouse07410/asn1c

🔥 Severity

この脆弱性は高危険度で、CVSSスコアは8.2です。リモート攻撃者がDoS攻撃を起こす可能性があります。

🔧 How to fix

asn1cのコードを修正し、ゼロ長のOERペイロードに対して適切にバイト数を検証してください。

🛡️ Workaround

パッチが公開されるまで、不正な入力データをフィルタリングして防御してください。

🔍 Detection

as1cのバージョンが1.4以前であることを確認し、ゼロ長OERペイロードの解析で異常がないか監視してください。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'c' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で c を grep し、稼働しているサービス・バージョンを把握する。
2
Match against affected range verify
```
Confirm if version satisfies `<= 1.4`
```
Step 1 で見つかったバージョンが影響範囲 <= 1.4 に該当するか照合。本番で稼働中ならインシデント扱い。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

References

advisory github.com
advisory github.com
advisory nvd.nist.gov