CVE-2026-73523

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/COVESA/Open1722/issues/154
https://www.vulncheck.com/advisories/covesa-open1722-stack-memory-disclosure-via-acf-can-listener-c-integer-truncation

Configurations

No configuration.

History

23 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) COVESA Open1722 hasta la versión 0.9.2 contiene una vulnerabilidad de truncamiento de entero en acf-can-listener.c que permite a atacantes remotos no autenticados hacer que el oyente CAN transmita memoria de pila de proceso al bus CAN al enviar un datagrama UDP rechazado con un ID de flujo AVTP coincidente. La variable num_can_msgs declarada como uint8_t trunca el valor de retorno de error -1 de avtp_to_can() a 255, causando que un bucle de escritura itere 255 veces sobre un array de pila de 15 ranuras y filtre aproximadamente 18 KB de memoria de pila adyacente como aproximadamente 240 tramas CAN a cualquier destinatario en el bus CAN.

Information

Published : 2026-08-17 18:18

Updated : 2026-10-23 16:10

NVD link : CVE-2026-73523

Mitre link : CVE-2026-73523

CVE.ORG link : CVE-2026-73523

JSON object : View

Products Affected

No product.

CWE

CWE-197

Numeric Truncation Error

{"id": "CVE-2026-73523", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73523", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T18:12:35.922686Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/COVESA/Open1722", "vendor": "COVESA", "product": "Open1722", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.9.2"}], "packageURL": "pkg:github/COVESA/Open1722", "defaultStatus": "affected"}]}], "published": "2026-08-17T18:18:14.170", "references": [{"url": "https://github.com/COVESA/Open1722/issues/154", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/covesa-open1722-stack-memory-disclosure-via-acf-can-listener-c-integer-truncation", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-197"}]}], "descriptions": [{"lang": "en", "value": "COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus."}, {"lang": "es", "value": "COVESA Open1722 hasta la versi\u00f3n 0.9.2 contiene una vulnerabilidad de truncamiento de entero en acf-can-listener.c que permite a atacantes remotos no autenticados hacer que el oyente CAN transmita memoria de pila de proceso al bus CAN al enviar un datagrama UDP rechazado con un ID de flujo AVTP coincidente. La variable num_can_msgs declarada como uint8_t trunca el valor de retorno de error -1 de avtp_to_can() a 255, causando que un bucle de escritura itere 255 veces sobre un array de pila de 15 ranuras y filtre aproximadamente 18 KB de memoria de pila adyacente como aproximadamente 240 tramas CAN a cualquier destinatario en el bus CAN."}], "lastModified": "2026-10-23T16:10:00.313", "sourceIdentifier": "disclosure@vulncheck.com"}