CVE-2026-120457EPSS p15.2%

CVE-2026-120457CVE-2026-120457

Description

libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS0.24% probability of exploitation · percentile 15.2% · 2026-11-03T12:00:27Z
Last modified2026-11-02
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.