CVE-2026-45615 Overview
CVE-2026-45615 is a heap out-of-bounds read vulnerability in mouse07410/asn1c, an ASN.1 compiler used to generate encoder and decoder code for network protocols. The flaw resides in the Octet Encoding Rules (OER) decoding skeleton file INTEGER_oer.c generated by asn1c versions 1.4 and earlier. When the generated decoder parses a maliciously crafted zero-length OER payload for a variable-length, non-negative INTEGER type, it fails to validate the available bytes before extracting the Most Significant Bit (MSB). This forces a precise 1-byte heap out-of-bounds read [CWE-20].
Critical Impact
Remote attackers can trigger denial of service or cause incorrect integer interpretation by sending crafted OER payloads to network services built with asn1c-generated parsers.
Affected Products
- mouse07410/asn1c ASN.1 compiler, versions 1.4 and earlier
- Applications using asn1c-generated OER decoders for INTEGER types
- Downstream protocol parsers for V2X, 5G telecom headers, and X.509 certificates built from vulnerable skeleton code
Discovery Timeline
- 2026-05-29 - CVE-2026-45615 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-45615
Vulnerability Analysis
The vulnerability exists in OER decoding logic that asn1c generates for variable-length, non-negative INTEGER ASN.1 types. OER encodes such integers as a length-prefixed octet string, and the decoder inspects the MSB to determine sign interpretation. The generated code reads the first content byte before confirming that the declared length is greater than zero. When an attacker supplies a length field of 0, the decoder dereferences memory immediately past the allocated payload buffer, producing a 1-byte out-of-bounds read on the heap.
The issue is classified under [CWE-20] Improper Input Validation. Although the read is small, asn1c-generated parsers commonly sit on the network attack surface for protocols such as Vehicle-to-Everything (V2X), 5G control plane signaling, and X.509 certificate processing. Adjacent heap memory contents leak into integer interpretation, producing non-deterministic decoded values.
Root Cause
The generated INTEGER_oer.c skeleton omits a bounds check between the parsed length prefix and the buffer remaining in the decoding context. The decoder branches on buf[0] & 0x80 to detect the MSB before validating that at least one byte is available, allowing access past the buffer boundary when length equals zero.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker sends a single crafted OER-encoded message containing an INTEGER field with a zero-length payload to any network endpoint that parses untrusted input with vulnerable asn1c-generated code. The out-of-bounds byte feeds back into the decoder, producing either an application crash through downstream invariants, a denial of service, or protocol state corruption when the poisoned integer drives subsequent logic such as session identifiers or certificate fields.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-wxx8-76rw-96j2 for technical details.
Detection Methods for CVE-2026-45615
Indicators of Compromise
- OER-encoded messages containing INTEGER fields with a length prefix of 0 arriving at network listeners
- Repeated parser crashes or restarts in services that use asn1c-generated decoders
- Anomalous decoded integer values in protocol logs that do not match the sender's claimed state
Detection Strategies
- Deploy AddressSanitizer or Valgrind in pre-production testing of services built from asn1c skeletons to surface the 1-byte heap read
- Inspect network captures for OER INTEGER fields where the length octet is 0x00 and flag them for review
- Correlate parser fault signals with upstream source addresses to identify scanning or fuzzing activity
Monitoring Recommendations
- Monitor process crash telemetry and core dumps on hosts running V2X, 5G, or PKI services compiled with asn1c
- Alert on bursts of malformed ASN.1 OER traffic from a single source
- Track upstream releases of asn1c and downstream protocol stacks for patched skeleton files
How to Mitigate CVE-2026-45615
Immediate Actions Required
- Inventory all binaries and services that link against code generated by asn1c version 1.4 or earlier
- Apply the patched skeleton files from the upstream mouse07410/asn1c repository and regenerate decoders
- Rebuild and redeploy any downstream applications that embed the regenerated OER decoders
- Place network-facing OER parsers behind input validation or a protocol-aware gateway until patching completes
Patch Information
Review the GitHub Security Advisory GHSA-wxx8-76rw-96j2 for the fixed commit and regeneration instructions. The patch adds a length check in INTEGER_oer.c before MSB extraction, ensuring the decoder rejects zero-length INTEGER payloads.
Workarounds
- Add an application-layer guard that rejects OER INTEGER fields with a zero-length prefix before passing data to the decoder
- Restrict exposure of vulnerable parsers to trusted network segments using firewall rules or service mesh policy
- Enable heap hardening features such as glibc MALLOC_CHECK_ or compiler-level sanitizers on critical parsing services
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
