Libaec
Monthly
This is a moderate, not emergency, priority: an out-of-bounds read in libaec through 1.1.7 (m_se_decode() in src/decode.c) lets a crafted CCSDS 121.0 / SZIP stream crash the decoder and potentially leak adjacent memory into decoded samples. The flaw is only reachable when an application built on libaec decodes attacker-supplied data that selects Second Extension coding and whose first fundamental sequence is longer than 2^31 zero bits, which wraps a signed index negative and defeats the bounds check; the vector is local with the victim feeding untrusted input to the decoder (UI:P / AT:P), and no authentication to the library is involved (PR:N). An upstream fix exists in PR #66, but a tagged patched release is not independently confirmed; there is no CISA KEV entry and no public exploit code confirmed at time of analysis, though a public technical writeup of the signedness issue is referenced.
This is a moderate, not emergency, priority: an out-of-bounds read in libaec through 1.1.7 (m_se_decode() in src/decode.c) lets a crafted CCSDS 121.0 / SZIP stream crash the decoder and potentially leak adjacent memory into decoded samples. The flaw is only reachable when an application built on libaec decodes attacker-supplied data that selects Second Extension coding and whose first fundamental sequence is longer than 2^31 zero bits, which wraps a signed index negative and defeats the bounds check; the vector is local with the victim feeding untrusted input to the decoder (UI:P / AT:P), and no authentication to the library is involved (PR:N). An upstream fix exists in PR #66, but a tagged patched release is not independently confirmed; there is no CISA KEV entry and no public exploit code confirmed at time of analysis, though a public technical writeup of the signedness issue is referenced.