CVE-2026-120457

Name of the Vulnerable Software and Affected Versions libaec versions prior to 1.1.8

Description An out-of-bounds read occurs in the m se decode() function within src/decode.c. This issue allows attackers to bypass a signed bounds check by using an overlong fundamental sequence. By providing a specially crafted CCSDS 121.0/SZIP stream containing 2^31 or more zero bits, an attacker can cause the decoder to crash or leak adjacent memory into decoded samples.

Recommendations Update libaec to version 1.1.8 or later.