libaec CVE-2026-120457

Exploitation requires that an application built on libaec (<= 1.1.7) decode an attacker-controlled CCSDS 121.0 / SZIP stream in which a Second Extension (SE) block's first fundamental sequence is longer than 2^31 zero bits; this overlong length wraps the signed index 'm' negative and defeats the signed bounds check in m_se_decode() (src/decode.c). The flaw is reachable only through the SE decoder path, so the input must select Second Extension coding. Limiting factors: the vector is local (AV:L) and needs the victim to feed untrusted data to the decoder (UI:P / passive interaction) plus the specific oversized-FS attack requirement (AT:P), meaning it is not a remote-by-default network exploit; no authentication to the library is needed (PR:N). Primary outcome is a decoder crash (availability) with a secondary possibility of adjacent memory being emitted into decoded samples (limited confidentiality). The vendor fix (PR #66) is the applicable remediation.

This is a moderate, not emergency, priority. The vendor-assigned CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N, base 5.8) describes a local-vector flaw (AV:L) that is triggered only when a victim application passes attacker-supplied data to the decoder (UI:P, passive interaction) and additionally carries an attack requirement (AT:P) - consistent with the description's precondition that the malicious stream must contain 2^31 or more zero bits before the signed bounds check is bypassed. Impact is weighted toward availability (VA:H, decoder crash) with limited confidentiality (VC:L, adjacent memory leaked into decoded samples) and no integrity impact. The decision label from the input is 'this_month', not act_now or emergency, which aligns with the local vector and conditional trigger. No EPSS score and no KEV listing are present in the input, so there is no signal of active exploitation or mass-scan probability; a public PoC reference exists (a technical write-up and a regression test in the fix PR), which raises the practical likelihood of exploit development but is not the same as active exploitation. The CVSS 4.0 PR:N correctly reflects that no authentication is needed against the library itself, but real-world risk hinges on whether an exposed application feeds untrusted CCSDS 121.0/SZIP streams to libaec. Overall: a real but bounded defect worth patching within the vendor's suggested month-level window rather than an immediate crisis.

An application that uses libaec (for example via HDF5/netCDF-based scientific data tooling) opens an attacker-supplied compressed data file or stream; the crafted CCSDS 121.0/SZIP payload encodes a Second Extension block whose fundamental sequence exceeds 2^31 zero bits, bypassing the signed bounds check in m_se_decode(). The decoder then reads out of bounds, crashing the process or copying adjacent heap memory into the decoded output. A public PoC reference exists (a hackmd write-up and a regression test in PR #66); it is not verified as working weaponized exploit code.