The vulnerability occurs in libaec versions up to 1.1.7, where an out-of-bounds read inside the m_se_decode() function can be triggered by an overlong fundamental sequence. By supplying a crafted CCSDS 121.0/SZIP stream containing 2^31 or more zero bits, an attacker can bypass a signed bounds check, causing the decoder to read beyond the allocated buffer. The result may be a crash of the decoder or leakage of adjacent memory into the decoded samples, exposing potentially sensitive data.

The affected product is the Deutsches Klimarechenzentrum "libaec" library, all releases up to and including version 1.1.7.

The CVSS score of 5.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA KEV. The exploit requires crafting a CCSDS stream with an excessively long zero sequence; this is a specialized attack that is more likely to occur in environments that process untrusted CCSDS data. Successful exploitation can lead to denial of service or potential information disclosure, depending on the memory contents revealed.