EUVD-2026-26689Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) receives memcpy at offset 1+pid_length with payload_length bytes. MAX_UDS_REQUEST_PAYLOAD_LENGTH=7, so 1+2+7=10 exceeds buffer by 4 bytes. No bounds check on payload_length before memcpy.
AnalysisAI
Stack buffer overflow in miaofng/uds-c library allows adjacent network attackers to execute arbitrary code via crafted diagnostic payload. The send_diagnostic_request function allocates only 6 bytes for MAX_DIAGNOSTIC_PAYLOAD_SIZE but accepts up to 7 bytes of payload (MAX_UDS_REQUEST_PAYLOAD_LENGTH), enabling 4-byte overflow when combined with pid_length=2. Affects commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a from October 2016 and likely later versions unless patched. No CISA KEV listing or EPSS data indicates exploitation remains theoretical; vulnerability appears in automotive diagnostic library with limited deployment exposure.
Technical ContextAI
The vulnerability exists in uds-c, a C implementation of the Unified Diagnostic Services (UDS) protocol used in automotive ECU communication (ISO 14229). The send_diagnostic_request function performs a memcpy operation into a 6-byte stack buffer starting at offset 1+pid_length (typically 1+2=3) for payload_length bytes. With MAX_UDS_REQUEST_PAYLOAD_LENGTH defined as 7, the maximum write is 1+2+7=10 bytes into a 6-byte buffer, creating a 4-byte overflow. The vulnerability stems from missing bounds validation on the payload_length parameter before the memcpy call, a classic CWE-120 (Buffer Copy without Checking Size of Input) pattern. This library appears to be a fork or variant of the OpenXC uds-c implementation, suggesting the vulnerability may exist in related codebases.
RemediationAI
Review the vulnerability analysis at https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 for technical details. Check upstream repositories (miaofng/uds-c and openxc/uds-c) for commits adding bounds validation on payload_length parameter in send_diagnostic_request function; no specific patched version number is confirmed from available data. If using affected commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a or nearby versions, apply source-level patch adding check: if (1 + pid_length + payload_length > MAX_DIAGNOSTIC_PAYLOAD_SIZE) return error before memcpy. For embedded systems where patching is infeasible, implement network-layer mitigations: restrict access to diagnostic interfaces using firewall rules allowing only trusted diagnostic tools, deploy network segmentation isolating vehicle/CAN networks from untrusted adjacent networks, and implement message filtering to reject UDS requests exceeding safe payload sizes at the gateway level. Note that disabling diagnostic services may impact legitimate maintenance and telemetry functions. Systems using this library only on physically isolated test benches face lower risk than production vehicle deployments.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today