redhat/libaec vulnerabilities

Latest redhat/libaec CVEs

Newest publication first

1. CVE-2026-120457 libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder

   Published 2026-11-02

   Medium·CVSS 5.8 EPSS 0.24%

   libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to cra...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.