CVE-2026-37532

High

Published: 01/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

AGL agl-service-can-low-level up to version 17.1.12 contains a heap buffer over-read in the isotp-c library. The issue arises when extracting payload length from a CAN frame, potentially leading to reading data beyond the allocated buffer.

Risk Assessment

Exploitation of this vulnerability may lead to unauthorized memory access, posing risks of data leakage or system crashes. Organizations should be aware of potential security threats to their applications.

Recommendation

It is recommended to update to the latest version of agl-service-can-low-level to mitigate this vulnerability. Additionally, conducting a source code audit to identify similar issues is advisable.

Other vulnerabilities in AGL agl-service-can-low-level

CVE-2026-37530High
AGL agl-service-can-low-level up to version 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function allocates a 6-byte stack buffer but copies up to 7 bytes, leading to controlled buffer overflow.

Original NVD description (English source)

AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer.