CVE-2026-37535

Katalog CVE

CVSS 7.1 · High EPSS 0,33%

Kerentanan Out-of-bounds Read. Skor CVSS 3.1 7.1 (High) menurut mitre.org.

Deskripsi (NVD)

openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information.

Rincian

Terbit di NVD

1 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.1 (High), sumber mitre.org
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381
• https://github.com/openxc/isotp-c
• https://github.com/openxc/isotp-c/blob/master/src/isotp/receive.c