CVE-2026-76077

{
  "etk_id": "ETK-2026-3651",
  "cve_id": "CVE-2026-76077",
  "display_id": "CVE-2026-76077",
  "ghsa_id": "GHSA-38q3-fg5h-wwf9",
  "euvd_id": "EUVD-2026-117601",
  "status": "published",
  "anchor_state": "anchored",
  "title": "XER decoder memory-safety flaws in asn1scc",
  "summary": "ASN1SCC releases before 4.7.0.1 contain memory-safety flaws in the runtime XER decoder. An attacker who can supply malformed XER data to an application that decodes it may cause crashes or hangs, expose memory, corrupt process state, or potentially execute code.",
  "mitigation": "Upgrade asn1scc to version 4.7.0.1 or later. Until upgrades are complete, prevent untrusted XER data from reaching ASN1SCC decode paths.",
  "vendor": "esa",
  "product": "asn1scc",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 4.7.0.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "4.7.0.1"
      ],
      "package_name": "asn1crt",
      "purl": null
    }
  ],
  "cwes": [
    120
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.441834366666667,
  "t0_at": "2026-11-05T16:49:58.765000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-05T16:49:58.765000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T16:49:58.765000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76077"
    }
  }
}