Skip to main content

Open1722 CVE-2026-73522

| EUVDEUVD-2026-60316 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-08-17 VulnCheck GHSA-r2g8-gx6q-pvxr
Stack Overflow Buffer Overflow Denial Of Service RCE Open1722
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Network-reachable, zero-auth, zero-interaction stack overflow with explicit RCE and DoS impact warrants C:H/I:H/A:H; no scope change since impact is confined to the vulnerable process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 17, 2026 - 18:19 vuln.today
CVE Published
Aug 17, 2026 - 17:53 cve.org
HIGH 8.7

DescriptionCVE.org

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory to achieve arbitrary code execution or denial of service.

AnalysisAI

Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack memory and achieve arbitrary code execution or denial of service by sending a single crafted UDP datagram containing more than 15 ACF-CAN messages. The root cause is an unbounded write index in the avtp_to_can() function, which increments unconditionally past the end of a fixed 15-slot stack array without comparing against the caller-supplied size. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify reachable Open1722 ACF-CAN listener UDP port
Delivery
Obtain or craft hardcoded plaintext AVTP stream identifier
Exploit
Send single crafted UDP datagram with 16+ ACF-CAN message structures
Execution
avtp_to_can() writes past 15-slot stack array boundary
Persist
Overwrite return address or frame pointer
Impact
Achieve arbitrary code execution or crash process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target system is running the Open1722 ACF-CAN listener component and that its UDP port is reachable from the attacker's network position. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.7 reflects AV:N/AC:L/AT:N/PR:N/UI:N, confirming a fully remote, low-complexity, unauthenticated attack surface with no special timing or positioning requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with UDP reachability to the Open1722 ACF-CAN listener constructs a datagram embedding the hardcoded cleartext stream identifier and containing 16 or more valid ACF-CAN message structures. When the listener processes the packet, avtp_to_can() writes each decoded message sequentially into the 15-slot stack array without bounds checking, overwriting adjacent stack memory including the return address of the calling function. …
Remediation No vendor-released patched version has been independently confirmed at time of analysis; operators should monitor the upstream GitHub issue at https://github.com/COVESA/Open1722/issues/154 and the VulnCheck advisory at https://www.vulncheck.com/advisories/covesa-open1722-stack-buffer-overflow-via-avtp-to-can-in-acf-can-listener for patch availability and commit a fix version when one is published. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all systems running COVESA Open1722 version 0.9.2 and earlier, document their network exposure, and implement network segmentation to restrict UDP traffic to the ACF-CAN listener from trusted sources only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Open1722

View all
CVE-2026-73523 HIGH
8.7 Aug 17

Stack memory disclosure in COVESA Open1722 through version 0.9.2 exposes approximately 18 KB of live process stack memor

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Stack Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Share

CVE-2026-73522 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy