Which versions of CANBoat are affected by CVE-2026-56790?

CANBoat versions through 6.22 are vulnerable to denial-of-service attacks via specially crafted network messages, causing the analyzer to crash and disrupting real-time monitoring of critical…. A patch is available.

Is there a public PoC exploit available for CVE-2026-56790?

Yes, a public proof-of-concept exploit is available for CVE-2026-56790. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-56790?

Within 24 hours: inventory all CANBoat deployments; identify current versions and determine which systems are running version 6.22 or earlier. Within 7 days: upgrade all affected CANBoat installations to the latest patched version per vendor advisory. Within 30 days: validate analyzer stability under production traffic loads and confirm no monitoring gaps.

CANBoat CVE-2026-56790

Q: What is the CVSS score of CVE-2026-56790?

CVE-2026-56790 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39532 HIGH

Off-by-one Error (CWE-193)

2026-06-25 VulnCheck

GHSA-p2cc-x7hq-6jvm

Buffer Overflow Denial Of Service Canboat

7.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Analyzer must be run by an operator over attacker-supplied input (UI:R, AV:L, PR:N); impact is a crash only, so availability-high with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 18:50 vuln.today

Analysis Generated

Jun 25, 2026 - 18:50 vuln.today

DescriptionCVE.org

CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overflow in the searchForPgn() function in analyzer/pgn.c that allows remote attackers to crash the application. Attackers can deliver a crafted NMEA-2000 message with an out-of-range PGN value over CAN bus or N2K-over-IP to trigger an out-of-bounds array access and denial of service.

AnalysisAI

Denial of service in CANBoat (the open-source NMEA 2000/CAN bus analyzer) through version 6.22 allows attackers to crash the analyzer by delivering a crafted NMEA-2000 message containing an out-of-range PGN value. The flaw is an off-by-one global buffer overflow in the searchForPgn() binary-search routine in analyzer/pgn.c, where an out-of-range PGN causes a one-element read past the end of the pgnList[] table. Publicly available exploit code exists (FuzzingLabs PoC value 393216 via issue #644), and a vendor patch is available; there is no public exploit identified as actively exploited.

Technical ContextAI

CANBoat is a toolset for decoding and encoding NMEA 2000 (N2K) marine network messages carried over CAN bus or tunneled as N2K-over-IP. Its analyzer maintains a sorted table, pgnList[], of known Parameter Group Numbers (PGNs) and resolves an incoming message's PGN via the searchForPgn() binary search in analyzer/pgn.c. The root cause is CWE-193 (off-by-one error): the search used an inclusive 'while (start <= end)' loop with 'end = mid - 1', so a PGN larger than every table entry converged to read pgnList[pgnListSize] - exactly one element beyond the array, a global buffer over-read. The fix in commit a5a22b7 (PR #649) switches to a half-open range 'while (start < end)' with 'end = mid', adds a 'mid >= pgnListSize' bounds guard, and uses overflow-safe midpoint arithmetic; the same PR also clamps an unrelated undefined 64-bit shift in fieldtype.c getMaxRange(). The affected product is identified by CPE cpe:2.3:a:canboat:canboat:*:*:*:*:*:*:*:* across all versions through 6.22.

RemediationAI

Upstream fix available (PR/commit); a released patched version is not independently confirmed from the input - update CANBoat to a build that includes commit a5a22b7 (PR #649), which is past the 6.22 release line. If you cannot rebuild immediately, the practical compensating control is to avoid feeding the analyzer untrusted or unvalidated N2K data: restrict the analyzer to known-good logs or trusted N2K sources, and isolate CANBoat hosts from any network path that could deliver attacker-crafted N2K-over-IP traffic (e.g., segment the marine/CAN network and block external access to the N2K-over-IP listener), accepting the trade-off that this limits live monitoring of untrusted segments. Because the impact is a crash rather than code execution, automatic restart/supervision of the analyzer process can reduce downtime as a stopgap. Track the patch through the vendor advisory at https://www.vulncheck.com/advisories/canboat-off-by-one-global-buffer-overflow-in-searchforpgn and the commit URL above.