CVE-2026-120457
Received Received - Intake

libaec Out-of-Bounds Read in m_se_decode

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120457

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Deutsches Klimarechenzentrum libaec 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-196 The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libaec through 1.1.7 has an out-of-bounds read flaw in the m_se_decode() function in src/decode.c. Attackers can exploit this by providing a specially crafted CCSDS 121.0/SZIP stream containing 2^31 or more zero bits. This bypasses a signed bounds check, potentially causing the decoder to crash or leak adjacent memory into decoded samples.

Detection Guidance

This vulnerability involves a crafted CCSDS 121.0/SZIP stream with excessive zero bits. Detection requires inspecting libaec library usage and input streams. Check for crashes or memory leaks when processing SZIP-compressed data. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to crash the libaec decoder or access sensitive memory. If you use libaec to process untrusted CCSDS 121.0/SZIP streams, an attacker might exploit this to disrupt operations or extract data from memory.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks or unauthorized memory disclosure. If exploited, it may lead to system crashes or expose sensitive data in memory, violating integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Update libaec to the latest version (1.1.7 or higher). Avoid processing untrusted SZIP streams. Implement input validation for CCSDS 121.0/SZIP data. Monitor for crashes or memory leaks in applications using libaec.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120457. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...