ASN.1 TypeScript ESM library, which provides BER and DER codecs, contains a flaw in versions 11.0.5 and earlier where decoding an INTEGER can expose the underlying ArrayBuffer. This leak can expose arbitrary internal data such as cryptographic keys or sensitive configuration stored within the buffer, leading to information disclosure. The weakness is identified as CWE-200, indicating an information exposure vulnerability.

CVE-2026-27452 affects the asn1-ts library distributed by Jonathan Wilbur, specifically all releases version 11.0.5 and earlier. Upgrades to version 11.0.6 and subsequent releases contain the patch that mitigates the vulnerability.

With a CVSS score of 9.2, CVE-2026-27452 is considered high severity, and although the EPSS score is below 1% indicating a low current exploitation probability, the vulnerability is not listed in the CISA KEV catalog. The flaw is local; an attacker who can supply crafted ASN.1 data to the decoding routine can trigger the leak. The likely attack vector is via an application that processes ASN.1 data from untrusted sources. This can lead to data exposure. The fix is straightforward via upgrading to 11.0.6, and no public exploit exploits have been documented. Given its local nature and low exploitation probability, monitoring and remediation remain priority actions.