CVE-2026-120457

A flaw was found in libaec. An attacker can cause a Denial of Service (DoS) or information disclosure by supplying a specially crafted compressed data stream. Due to an out-of-bounds read vulnerability in the decoding function (m_se_decode), an overlong sequence bypasses bounds checking, causing the application to crash or leak adjacent memory into decoded output.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.