CVE-2026-54413
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Version 0.9.0 of the driftregion iso14229 library contains an integer underflow and out-of-bounds read issue in the Handle_0x27_SecurityAccess() function. An unauthenticated remote attacker can crash a UDS server and potentially read memory past the receive buffer by sending a specific request.
Risk Assessment
Organizations using vulnerable systems may experience server crashes and unauthorized access to memory, potentially leading to sensitive data leaks.
Recommendation
It is recommended to update the driftregion iso14229 library to a version where the issue is fixed and to implement additional security measures to restrict access to the UDS server.
Original NVD description (English source)
driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess() function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. The handler reads the SecurityAccess subFunction from recv_buf[1] without first checking that recv_len is at least 2, then computes the key-data length as the unsigned subtraction (uint16_t)(recv_len - UDS_0X27_REQ_BASE_LEN); when recv_len equals 1 the result underflows to 65535 and is passed as args.len to the application's SecAccessValidateKey or SecAccessRequestSeed callback, which typically iterates or copies that many bytes from the 4-KB receive buffer. Every other UDS sub-function handler in the library (0x10, 0x11, 0x14, 0x19, 0x22, 0x23, 0x28, and others) performs an explicit recv_len lower-bound check before indexing; Handle_0x27_SecurityAccess is the sole outlier. The vulnerable handler reaches over CAN bus, OBD-II, ISO-TP, and DoIP transports and is exposed in the default diagnostic session without prior authentication; deployments on automotive ECUs, industrial controllers, and IoT devices that ship iso14229 as their UDS server are affected.