CVE-2026-45615: mouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in `INTEGER_decode_oer` via Malformed OER Payload

Synopsis

A 1-byte heap out-of-bounds read in the OER decoding skeleton generated by mouse07410/asn1c (INTEGER_oer.c's INTEGER_decode_oer) affects version 1.4 and earlier. The bug is reachable over the network with no authentication and no user interaction by sending a malformed zero-length OER payload for a variable-length non-negative INTEGER, which causes the decoder to read past the buffer when extracting the most significant bit. Successful exploitation crashes the parser (denial of service) or yields a corrupted integer value that can poison downstream protocol state or bypass application logic. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  AV:N: the attacker reaches the vulnerable decoder by sending a crafted OER payload over the network, typical for V2X, 5G, or X.509 parsing surfaces.

• AuthenticationNot required

  PR:N: no credentials are needed; any unauthenticated sender that can deliver an OER message to the parser can trigger the bug.

• Victim interactionNot required

  UI:N: exploitation happens entirely inside the decoder when the malformed payload is processed, with no user action required.

• Attack complexityDetail

  AC:L: crafting a zero-length OER INTEGER payload is trivial and the out-of-bounds read fires deterministically on the first parse.

Blast Radius

• Crashes the asn1c-generated decoder process, taking down protocol handlers for V2X, 5G signaling, or X.509 certificate validation (A:H).
• Returns an attacker-influenced integer value to the calling application, enabling protocol state poisoning or logic bypass in code that trusts the decoded field (I:L).
• Adjacent heap byte contents may influence the resulting integer, giving an attacker a narrow oracle into process memory layout even though confidentiality impact is rated none.