Skip to main content

COVESA Open1722 EUVDEUVD-2026-60321

| CVE-2026-73523 HIGH
Numeric Truncation Error (CWE-197)
2026-08-17 VulnCheck GHSA-ggx8-w5hw-4h29
Information Disclosure Open1722
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

UDP-reachable listener, no authentication required, scope unchanged; only confidentiality is impacted as stack memory leaks to CAN bus with no write or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 17, 2026 - 18:38 vuln.today
CVE Published
Aug 17, 2026 - 18:00 cve.org
HIGH 8.7

DescriptionCVE.org

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

AnalysisAI

Stack memory disclosure in COVESA Open1722 through version 0.9.2 exposes approximately 18 KB of live process stack memory onto the CAN bus, reachable by any node on that bus. An unauthenticated remote attacker sends a crafted UDP datagram bearing a matching AVTP stream ID; integer truncation in acf-can-listener.c converts avtp_to_can()'s -1 error return to 255 in a uint8_t variable, driving the write loop 255 times over a 15-slot stack array and emitting roughly 240 CAN frames of raw stack contents. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Discover or sniff active AVTP stream ID on target network
Delivery
Send crafted UDP datagram with matching stream ID to CAN listener
Exploit
avtp_to_can() returns -1 error
Install
uint8_t truncation converts -1 to 255
C2
Write loop iterates 255 times over 15-slot stack array
Execute
~240 CAN frames carrying ~18 KB of stack memory broadcast to CAN bus
Impact
CAN bus participant collects leaked process memory
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Open1722 ACF-CAN listener (acf-can-listener) must be running and its UDP port must be reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the severity: unauthenticated, low-complexity, network-accessible exploitation with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with UDP network access to the Open1722 ACF-CAN listener crafts a datagram containing a valid-format AVTP stream ID matching an active stream but otherwise malformed to trigger an avtp_to_can() error return. The integer truncation silently converts the -1 failure to 255, causing the listener to emit approximately 240 CAN frames carrying raw stack contents - potentially including process keys, pointers, or internal state - to every node on the attached CAN segment without any authentication or session establishment.
Remediation No confirmed patched release version appears in the available data; patch availability should be tracked directly via the GitHub issue at https://github.com/COVESA/Open1722/issues/154. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit all systems running COVESA Open1722 versions through 0.9.2 and document their deployment context; implement network segmentation or physical access controls to restrict CAN bus exposure to authorized nodes only, and enable CAN traffic logging to detect exploitation attempts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Open1722

View all
CVE-2026-73522 HIGH
8.7 Aug 17

Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack

Same weakness CWE-197 – Numeric Truncation Error

View all
CVE-2022-42475 CRITICAL POC
9.8
CVE-2025-6965 HIGH POC
7.2
CVE-2020-15202 CRITICAL POC
9.0
CVE-2026-63525 HIGH
7.8
CVE-2024-43639 CRITICAL
9.8
CVE-2026-55142 MEDIUM
5.5
CVE-2024-21391 HIGH
8.8
CVE-2024-21352 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-60321 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy