PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45615 mouse07410 CVE debrief

A memory safety vulnerability exists in the OER (Octet Encoding Rules) decoding skeleton files generated by mouse07410/asn1c versions 1.4 and earlier. The flaw resides in INTEGER_oer.c, where the decoder fails to validate required bytes before extracting the Most Significant Bit (MSB) when parsing a zero-length OER payload for variable-length, non-negative INTEGER types. This results in a precise 1-byte heap out-of-bounds read. Because asn1c-generated code is commonly deployed to parse untrusted network inputs—including V2X protocols, 5G telecom headers, and X.509 certificates—remote attackers can exploit this vulnerability to cause denial of service or trigger incorrect integer interpretation in downstream applications, potentially leading to protocol state poisoning or logic bypass. The vulnerability was published on May 29, 2026, and modified later the same day. No known exploitation in ransomware campaigns has been reported.

Vendor
mouse07410
Product
asn1c
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations operating V2X communication systems, 5G network infrastructure, PKI/certificate authorities using asn1c-generated code, and developers of embedded or telecommunications software relying on OER-encoded ASN.1 data should prioritize assessment and patching.

Technical summary

The vulnerability is a 1-byte heap out-of-bounds read in the OER INTEGER decoder generated by asn1c. When processing a zero-length payload for variable-length non-negative INTEGER types, the decoder attempts to extract the MSB without first validating that sufficient bytes exist in the buffer. This occurs in INTEGER_oer.c, part of the code skeletons generated by asn1c. The flaw is exploitable remotely when generated decoders process untrusted network input, with primary deployment contexts including V2X automotive networks, 5G telecommunications infrastructure, and X.509 certificate parsing. Impact ranges from denial of service through application crash to potential logic bypass via integer misinterpretation.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to a patched version of asn1c when available; monitor the GitHub Security Advisory for release announcements
  • Regenerate all OER decoding skeleton files using a fixed version of asn1c and recompile dependent applications
  • Implement input validation to reject zero-length OER INTEGER payloads before passing to generated decoders
  • Deploy memory safety mitigations including Address Space Layout Randomization (ASLR) and heap hardening for applications processing untrusted ASN.1 data
  • Conduct code review of downstream applications for integer interpretation logic that could amplify impact of corrupted values
  • Monitor application logs for anomalous OER decoding failures that may indicate exploitation attempts

Evidence notes

Vulnerability confirmed through GitHub Security Advisory GHSA-wxx8-76rw-96j2. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. CWE classifications: CWE-20 (Improper Input Validation), CWE-125 (Out-of-bounds Read), CWE-130 (Improper Handling of Length Parameter Inconsistency).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45615 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45615

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45615 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45615

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.