The vulnerability in mouse07410/asn1c (<= 1.4) involves improper input validation in the OER decoding code generated by asn1c, specifically in INTEGER_oer.c. When a zero-length OER payload is parsed for a variable-length, non-negative INTEGER, the decoder does not validate the presence of required bytes before reading the Most Significant Bit, causing a 1-byte heap out-of-bounds read. This memory safety issue can be exploited remotely via untrusted network inputs such as V2X protocols, 5G telecom headers, or X.509 certificates, potentially leading to denial of service or logic errors in applications relying on asn1c.

Exploitation of this vulnerability can cause a denial of service (application crash) or incorrect integer interpretation, which may lead to protocol state poisoning or logic bypass in downstream applications. There is no confidentiality impact reported. The CVSS score of 8.2 reflects high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Users should monitor the vendor project for updates and consider applying any future patches promptly. Until a fix is available, avoid processing untrusted OER payloads with affected versions or implement additional input validation controls at the application level if feasible.