Driftregion iso14229 CVE-2026-111282

The target must run the iso14229 UDS server at a version before 0.10.1 with the RequestFileTransfer service (SID 0x38) handler reachable and a file-transfer callback registered. The attacker sends a crafted 0x38 request setting filePathAndNameLength to 0xFFFC-0xFFFF, which wraps around and defeats the buffer-length check; per PR:N no authentication is required and per UI:N no user interaction is needed. The primary limiting factor is transport reachability: AV:N holds only when the diagnostic server is exposed over an IP transport such as DoIP, whereas the common CAN/ISO-TP deployment restricts the attacker to the vehicle/device bus (adjacent access). Exploitation also depends on the integrating product actually enabling the 0x38 service and, depending on implementation, having an appropriate diagnostic session active.

This is a credible, actionable priority within its deployment niche, though not an internet-scale emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, low-complexity attack requiring no user interaction, and CWE-190 (integer wraparound) with the concrete description of bypassing the file-path length check via filePathAndNameLength 0xFFFC-0xFFFF is technically well-substantiated by the linked commit and source line range (server.c#L1151-L1161). Impact is primarily availability (VA:H - crash, consistent with the 'Denial Of Service' tag) with limited confidentiality exposure (VC:L - out-of-bounds read disclosing adjacent memory); there is no integrity impact. Key tempering signals: no CISA KEV listing, no EPSS score provided, and no public exploit code referenced - this was a VulnCheck research disclosure with a vendor patch, indicating a responsibly-handled finding rather than observed in-the-wild abuse. The most important caveat is the attack vector: AV:N assumes the UDS server is reachable over an IP transport (e.g. DoIP), but iso14229 is transport-agnostic and a large share of real deployments run over CAN/ISO-TP, where exploitation requires adjacent bus access rather than remote network reach - verify the transport before treating this as remotely exploitable. Overall: a real bug worth patching promptly on affected ECUs/gateways, but real-world exposure hinges heavily on transport and product footprint.

An attacker with reachability to a device running the iso14229 UDS server (before 0.10.1) sends a short RequestFileTransfer (SID 0x38) message with filePathAndNameLength set to 0xFFFC-0xFFFF. The integer wraparound defeats the length validation so the registered file-transfer callback reads far past the receive buffer, crashing the target or returning leaked memory contents. No public exploit code is referenced, but the vendor advisory and patch commit precisely identify the vulnerable path, making a proof-of-concept straightforward to reconstruct.