EUVD-2026-60323
GHSA-77m7-4hpw-56g7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network UDP with no sender filter; scope changes as downstream Autoware nodes are affected; confidentiality low from heap leak via fabricated point coordinates.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.
AnalysisAI
Out-of-bounds heap read in TIER IV Nebula's Vlp32Decoder::unpack() function through version 1.2.0 enables unauthenticated remote attackers to inject fabricated LiDAR point data into autonomous vehicle perception pipelines by sending short malformed UDP datagrams to the Velodyne sensor port. Unlike other Nebula sensor drivers, the VLP-32 UDP listener enforces no sender-address restrictions, making any network-reachable host a valid attacker origin without spoofing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Vlp32Decoder must be the active LiDAR driver configured for a Velodyne VLP-32C sensor - this vulnerability does not affect other sensor decoders in the Nebula library, which implement sender-address restrictions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a genuinely low-friction attack path - no authentication, no special attack conditions, and a network-accessible UDP port with no sender filtering. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to the network segment hosting the Velodyne VLP-32 UDP sensor port - via shared sensor LAN, firewall gap, or direct network adjacency - crafts a UDP datagram shorter than the minimum expected VLP-32 packet length and sends it to the Nebula listener port, requiring no credentials or source-address spoofing due to the absent sender filter. Vlp32Decoder::unpack() reads past the end of this short datagram into adjacent heap allocations, generating synthetic LiDAR point coordinates populated with heap contents; these points are published without integrity verification into the ROS 2 PointCloud2 topic consumed by Autoware perception nodes, potentially causing phantom obstacle detection or suppression of real objects in the vehicle's world model. |
| Remediation | No specific patched release version has been confirmed in available intelligence at time of analysis; the upstream GitHub issue at https://github.com/tier4/nebula/issues/488 must be monitored for a fix version before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all deployed systems running TIER IV Nebula version 1.2.0 or earlier with Velodyne VLP-32 sensors and identify which are reachable from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code
Unauthenticated disclosure and modification of runtime configuration in NebulaGraph (vesoft-inc nebula) through version
Nebula is a scalable overlay networking tool. [CVSS 8.1 HIGH]
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today