CVE-2026-120457: libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder

Q: Which deployments are realistically exposed?

Deployments are exposed when they use libaec to decode CCSDS 121.0/SZIP streams supplied by an attacker or another untrusted source. The affected software listings include Ubuntu and Debian libaec packages.

Q: What must an attacker provide to trigger the issue?

The attacker must cause the decoder to process a crafted CCSDS 121.0/SZIP stream containing an overlong fundamental sequence with 2^31 or more zero bits. No privileges are indicated, but user interaction is required by the supplied severity vector.

Q: How can impact be recognized during triage?

A vulnerable decoder may crash while processing the crafted stream, or adjacent memory may appear in decoded samples. Versions through 1.1.7 are identified as affected.

Published Nov 2, 2026

Updated

libaec through 1.1.7 contains an out-of-bounds read vulnerability in msedecode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.

Affected Software

11 affected components

debian/libaec*

debian/libaec<=1.0.6-1, <=1.1.3-1, <=1.1.7-1

ubuntu/libaec*

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·03:17 PM

Affected Software

Frequently Asked Questions

Which deployments are realistically exposed?

Deployments are exposed when they use libaec to decode CCSDS 121.0/SZIP streams supplied by an attacker or another untrusted source. The affected software listings include Ubuntu and Debian libaec packages.

What must an attacker provide to trigger the issue?

The attacker must cause the decoder to process a crafted CCSDS 121.0/SZIP stream containing an overlong fundamental sequence with 2^31 or more zero bits. No privileges are indicated, but user interaction is required by the supplied severity vector.

How can impact be recognized during triage?

A vulnerable decoder may crash while processing the crafted stream, or adjacent memory may appear in decoded samples. Versions through 1.1.7 are identified as affected.

CVE-2026-120457: libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder

Affected Software

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What must an attacker provide to trigger the issue?

How can impact be recognized during triage?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What must an attacker provide to trigger the issue?

How can impact be recognized during triage?