CVE-2026-73522

HighCVSS 7.5

Published: 17/08/2026(UTC)Updated: 24/09/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

3.95%

90th percentile - higher than 90% of all known CVEs

Summary

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory to achieve arbitrary code execution or denial of service.

Risk Assessment

The risk includes remote code execution or denial of service, which could lead to full system compromise or disruption of operations.

Recommendation

It is recommended to upgrade COVESA Open1722 to a version newer than 0.9.2 and to implement authentication and message length validation.

Other vulnerabilities in COVESA Open1722

CVE-2026-73523High
COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS