CVE-2026-73522

Name of the Vulnerable Software and Affected Versions COVESA Open1722 versions 0.1722 through 0.9.2

Description A stack buffer overflow occurs when unauthenticated remote attackers send a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp to can() function increments its write index without bounding it against the caller-supplied array size. Since the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory, potentially leading to arbitrary code execution or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.