CVE-2026-62381

Name of the Vulnerable Software and Affected Versions luci-lib-px5g versions 18.06 through 25.12

Description A heap-based buffer overflow exists in the native ASN.1 encoding routine asn1 add obj() within x509write.c when signing a certificate using a 2040-bit RSA key. The issue occurs because the BIT STRING allocation is calculated based on the DER length encoding of 255 bytes, but the actual payload written, including the unused-bits byte, is 256 bytes. This requires an additional DER length octet, resulting in an allocation of 259 bytes while 260 bytes are required. Consequently, the final memcpy() operation writes one byte beyond the heap buffer. This flaw is accessible through the exported Lua interface via the create selfsigned() function.

Recommendations As a temporary workaround, restrict the use of the create selfsigned() function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.