COVESA Open1722 EUVD-2026-60321

The Open1722 ACF-CAN listener (acf-can-listener) must be running and its UDP port must be reachable by the attacker. The attacker must supply a UDP datagram whose AVTP stream ID matches one the listener is tracking, but which causes avtp_to_can() to return an error - the matching stream ID is the specific trigger condition. No authentication is required. Exploitation is bounded to deployments using Open1722's ACF-CAN bridge specifically; AVTP-only instances without the CAN listener component are unaffected. Retrieval of leaked stack contents requires a receiver on the CAN bus (the attacker, a compromised node, or passive monitoring equipment), which may require physical or logical CAN bus access beyond the initial UDP send - this dual-network requirement limits opportunistic, fully remote exploitation.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the severity: unauthenticated, low-complexity, network-accessible exploitation with high confidentiality impact. No EPSS data was supplied in the input, so exploitation probability cannot be quantified statistically. No CISA KEV listing exists and no POC code has been identified, though the VulnCheck advisory provides enough mechanical detail that weaponization requires minimal effort. One nuance complicates the threat model: leaked memory is broadcast onto the CAN bus rather than returned directly to the UDP sender, so the attacker may additionally need CAN bus read access to harvest the leaked frames - this is inferred from the description and not explicitly confirmed. In operational automotive or industrial environments where CAN bus access is physically or logically shared, this distinction matters little. For deployments where CAN and IP networks are strictly segregated, the realistic attacker profile narrows. There is no integrity or availability impact, but stack memory leakage in a networked process carries a meaningful risk of secondary credential or key exposure.

An attacker with UDP network access to the Open1722 ACF-CAN listener crafts a datagram containing a valid-format AVTP stream ID matching an active stream but otherwise malformed to trigger an avtp_to_can() error return. The integer truncation silently converts the -1 failure to 255, causing the listener to emit approximately 240 CAN frames carrying raw stack contents - potentially including process keys, pointers, or internal state - to every node on the attached CAN segment without any authentication or session establishment.