EUVD-2026-26692Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames.
AnalysisAI
Remote code execution in cannelloni v2.0.0 allows unauthenticated network attackers to crash the service or execute arbitrary code by sending malformed CAN FD frames that trigger buffer overflows in two separate parsing functions (parseCANFrame in parser.cpp and decodeFrame in decoder.cpp). The CVSS score of 9.8 reflects network-accessible exploitation requiring no authentication or user interaction, with complete system compromise possible. Public proof-of-concept code exists (GitHub Gist reference), elevating immediate exploitation risk despite no CISA KEV listing, suggesting targeted rather than mass exploitation scenarios.
Technical ContextAI
Cannelloni is a SocketCAN-over-UDP tunneling application used in automotive and industrial control systems to transport Controller Area Network (CAN) traffic over IP networks. The vulnerability affects the CAN Flexible Data-Rate (CAN FD) frame processing logic in two critical parsing functions. Buffer overflow vulnerabilities occur when input validation fails to properly bound-check frame data before copying it into fixed-size memory buffers. CAN FD frames can carry up to 64 bytes of data (versus 8 bytes in classic CAN), and the parsing code in parser.cpp::parseCANFrame and decoder.cpp::decodeFrame appears to lack proper length validation when processing these extended payloads. This allows attackers to write beyond allocated buffer boundaries, potentially overwriting adjacent memory including return addresses, function pointers, or security-critical data structures. The network-accessible attack surface (AV:N) combined with no authentication requirements (PR:N) means any network peer sending UDP traffic to the cannelloni service can trigger the vulnerability.
RemediationAI
No vendor-released patch or fixed version has been identified in the provided references at time of analysis. The GitHub repository (https://github.com/mguentner/cannelloni) should be monitored for security updates, commits addressing CVE-2026-37539, or maintainer advisories. Until an official patch is available, implement network-level access controls to restrict cannelloni UDP endpoints to trusted source IP addresses only, blocking public internet exposure entirely. Deploy cannelloni instances behind application-layer firewalls configured to validate CAN FD frame structures and enforce maximum data length limits (64 bytes for CAN FD) before forwarding to the vulnerable service. Consider replacing cannelloni with alternative CAN-over-IP solutions that have undergone recent security audits, particularly for production automotive or safety-critical industrial deployments. If continued use is required, run cannelloni in isolated network segments with strict egress filtering to prevent lateral movement if code execution is achieved, and deploy runtime exploit mitigation technologies (ASLR, DEP/NX, stack canaries) on host systems, though these provide defense-in-depth rather than vulnerability elimination. For development/testing environments, disable CAN FD support entirely if classic CAN (8-byte frames) suffices, reducing attack surface. The proof-of-concept reference (https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381) may provide insights into exploitation mechanisms but should only be accessed in controlled research environments.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today