DEBIAN-CVE-2026-120457: Medium severity debian/libaec vulnerability
Published Nov 2, 2026
·Updated
libaec through 1.1.7 contains an out-of-bounds read vulnerability in msedecode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.
Affected Software
3 affected components
debian/libaec*
debian/libaec*
debian/libaec*
Event History
Nov 2, 2026
CVE Published
via OSV·03:17 PM
Data Sourced
via OSV·03:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What input is required to trigger this issue?
An attacker must be able to supply a crafted CCSDS 121.0/SZIP stream containing 2^31 or more zero bits to the vulnerable decoder.
2
What impact can successful exploitation have?
The crafted stream can cause the decoder to crash or can leak adjacent memory into decoded samples.
3
Which libaec versions are affected?
The issue is described as affecting libaec through version 1.1.7.