asn1c EUVD-2026-114330

Exploitation requires that a consuming application decode attacker-supplied ASN.1 data (APER, UPER, BER, or OER) through asn1c-generated OPEN_TYPE_*_get decoders, and that the decoded OPEN TYPE member pointer (*memb_ptr2) was not previously allocated - the NULL case the conditional check fails to cover before unconditional pointer arithmetic at line ~54. The advisory demonstrates this concretely with the E2AP types E2connectionUpdateAcknowledge (UPER trace) and E2connectionUpdateFailure (APER trace), noting E2AP itself uses APER, and supplies a minimal BER reproducer. Limiting factors: the vulnerability only matters for programs that actually invoke these generated OPEN TYPE decoders on untrusted input, impact is confined to a crash (DoS) with no demonstrated code execution or data exposure, and affected builds are those using the vulnerable asn1c skeletons prior to v1.2.5.

This is a CWE-476 NULL-pointer dereference in the mouse07410/asn1c ASN.1 compiler's generated OPEN TYPE decoders, and every signal points to a denial-of-service (crash), not a confidentiality or integrity compromise. The vuln.today decision label is 'awaiting_data', not an act_now/emergency state. There is no CISA KEV listing (not confirmed actively exploited) and no EPSS score supplied, so widespread exploitation cannot be quantified from the input. However, a public reproducer is attached to the GHSA-rcj5-gcvg-x796 advisory (a BER crash tarball plus demonstrated UPER/APER ASAN traces for E2connectionUpdateAcknowledge/Failure), the reporter states the crash reproduces reliably against both this repo and upstream vlm, and the fix is confirmed in v1.2.5 - so this is a real, confirmed, low-complexity defect rather than a theoretical one. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) lists ALL impact metrics as N (VC:N/VI:N/VA:N), which directly conflicts with the evidence: a segmentation fault that crashes the consuming program is an availability impact, so the published vector appears to understate impact and should be verified. In practical terms this is a moderate-priority DoS bug whose real-world risk is driven entirely by whether a given deployment feeds untrusted encoded input to asn1c-generated OPEN TYPE decoders (e.g., O-RAN E2AP stacks); it is not a high-CVSS remote-code-execution emergency.

An attacker who can deliver crafted APER/UPER/BER/OER-encoded data to a program built with asn1c-generated OPEN TYPE decoders - for example an O-RAN E2 node or Near-RT RIC parsing E2AP messages such as E2connectionUpdateAcknowledge - sends a message whose OPEN TYPE member pointer was never allocated. During decode the code performs NULL + member-offset pointer arithmetic and reads it, producing a segmentation fault that crashes the process (denial of service). A public crash reproducer is attached to the GHSA advisory, so the trigger is demonstrated; it is a crash reproducer and is not verified as weaponized code execution.