CVE-2025-55398

9.8 criticalEPSS 0.4%

Critical (9.8). EPSS 0.4% chance of exploitation in the next 30 days.

An issue was discovered in mouse07410 asn1c thru 0.9.29 (2025-03-20) - a fork of vlm asn1c. In UPER (Unaligned Packed Encoding Rules), asn1c-generated decoders fail to enforce INTEGER constraints when the bound is positive and exceeds 32 bits in length, potentially allowing incorrect or malicious input to be processed.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-1284
Published: 2025-08-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/mouse07410/asn1c/issues/222

Check your stack JSON