Out-of-bounds write in ESA asn1scc generated ACN decoders via unchecked size determinant

Summary

The ASN1SCC compiler, maintained by the European Space Agency, generates C decoders from ASN.1 schemas with ACN (ASN.1 Control Notation) encoding instructions. When generating decoders for OCTET STRING and BIT STRING fields that carry an ACN size determinant, the compiler emitted code that read the wire-supplied length and passed it directly to a memcpy without checking it against the field’s declared SIZE constraint.

An attacker who controlled the encoded message could set the size determinant to any value the wire format permits, causing the generated decoder to write between 1 and 223 bytes past the end of a stack-allocated fixed-size array. Both the length and the content of the overwrite were attacker-controlled.

Root cause

The generated C decoder called getSizeDeterminantWireMax to compute the maximum value the size field could carry on the wire, but then used that wire-maximum as the buffer bound for the memcpy rather than the schema-declared uperRange (the actual SIZE constraint). The guard that should have rejected an over-sized determinant before the copy was never emitted.

Impact

Any system using ASN1SCC-generated C code to decode ACN-encoded messages from an untrusted source is vulnerable to a stack buffer overflow. The overflow length and content are attacker-controlled. Depending on the target architecture, compiler, and stack layout, this could lead to denial of service, data corruption, or arbitrary code execution.

Verification

I built the patched compiler (4.9.11.0), regenerated the C decoders from the original schema, and confirmed that the emitted code now includes a bounds check against the SIZE constraint before the copy. Under AddressSanitizer, the patched decoder correctly rejects a message with an oversized determinant, and the original overflow no longer reproduces. As a control, removing the new guard from the patched output restores the overflow under ASAN.

Timeline

• 01 Oct 2026 · ReportedSubmitted through ESA’s vulnerability disclosure program on Intigriti. Coordinated through ESACERT.
• 09 Oct 2026 · FixedESA released asn1scc 4.9.11.0 with the bounds check. Retest confirmed the fix.
• 12 Oct 2026 · Advisory publishedGHSA-g49g-f3f6-g578 published on GitHub with CVSS 8.2 High.

Credit

Reported by Merrick Hare, Enterprise Hare LLC. The full technical write-up is published at merrickhare.com.

No proof-of-concept code is published. The vendor has remediated the issue.