{"id":"CVE-2026-120457","published":"2026-11-02T15:17:29.507","lastModified":"2026-11-02T19:34:23.993","description":"libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","cwes":["CWE-196"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.7/src/decode.c#L556-L586","tags":[]},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/issues/64","tags":[]},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/pull/66","tags":[]},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/releases/tag/v1.1.7","tags":[]},{"url":"https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read","tags":[]},{"url":"https://www.vulncheck.com/advisories/libaec-through-1.1.7-out-of-bounds-read-via-m-se-decode-second-extension-decoder","tags":[]},{"url":"https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read","tags":[]}],"exploitRefs":[{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.7/src/decode.c#L556-L586","tags":[]},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/issues/64","tags":[]},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/pull/66","tags":[]},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/releases/tag/v1.1.7","tags":[]}],"hasPoc":true,"ai":null}