EUVD-2026-26687Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transport_Protocol_Data_Transfer,allows attackers to write to arbitrary memory via crafted sequence number from the CAN frame.
AnalysisAI
Integer underflow in Open-SAE-J1939 library's transport protocol handler enables remote unauthenticated attackers to corrupt arbitrary memory locations via manipulated CAN frame sequence numbers. CVSS 9.8 reflects network-accessible attack surface with no authentication barriers, though exploitation requires deployment in CAN-connected environments (industrial control systems, automotive networks). EPSS data unavailable; SSVC indicates total technical impact with automated exploitation potential but no confirmed active exploitation.
Technical ContextAI
Open-SAE-J1939 is an open-source implementation of the SAE J1939 protocol for Controller Area Network (CAN) communication, widely used in heavy-duty vehicles and industrial automation. The vulnerability resides in SAE_J1939_Read_Transport_Protocol_Data_Transfer function, which handles multi-packet message reassembly per J1939 transport protocol specifications. CWE-191 (integer underflow) occurs when processing the sequence number field from incoming CAN frames - insufficient bounds checking allows negative arithmetic results, causing buffer indexing to wrap around to high memory addresses. This affects all versions through commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (November 30, 2025). The network attack vector (AV:N) reflects CAN bus accessibility, which may be remote in telematics-enabled systems or require local CAN segment access depending on deployment architecture.
RemediationAI
Update to Open-SAE-J1939 commit later than b6caf884df46435e539b1ecbf92b6c29b345bdfe by pulling latest changes from https://github.com/DanielMartensson/Open-SAE-J1939 master branch. No specific patched version tag is confirmed in available data - integrators must verify commit history post-November 2025 for bounds-checking fixes in SAE_J1939_Read_Transport_Protocol_Data_Transfer function. If immediate patching is infeasible, implement defense-in-depth: restrict CAN bus access to authenticated devices only (physically secure OBD-II ports, disable remote diagnostic services), deploy CAN gateway firewalls to filter malformed J1939 transport protocol frames with invalid sequence numbers (sequence counter validation before processing), enable memory protection mechanisms (DEP/NX, ASLR) on host systems where supported to limit arbitrary write exploitation. Note that sequence number filtering may cause legitimate multi-packet messages to fail if validation logic is overly restrictive - test thoroughly in non-production environments. For safety-critical systems, consider migrating to formally verified CAN stack implementations.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-191 – Integer Underflow
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today