CVE-2026-37535
HIGH EPSS 10.6%
Published May 1, 20262mo ago · Modified Jun 17, 20261w ago
7.1 CVSS 3.1
Published May 1, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago
Description
openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Attack Vector Adjacent
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
10.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-125 Out-of-bounds Read Memory Safety
References 3
- gist.github.com https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381
- github.com https://github.com/openxc/isotp-c
- github.com https://github.com/openxc/isotp-c/blob/master/src/isotp/receive.c
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.