CVE-2026-111282: iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle0x38RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Driftregion iso14229 versions before 0.10.1 are affected if they process unauthenticated RequestFileTransfer requests (SID 0x38). The issue is reachable over the network with no privileges or user interaction required.
What does an attacker need to send?
An attacker can send a short RequestFileTransfer request with filePathAndNameLength set between 0xFFFC and 0xFFFF. The integer wraparound bypasses the file path length check and can cause callbacks to read beyond the receive buffer.
What is the likely impact?
Out-of-bounds reads can crash the target, resulting in denial of service, or disclose memory contents. The reported severity vector indicates high availability impact and low confidentiality impact, with no reported integrity impact.
How can I determine whether an instance is affected?
Check whether the application includes iso14229 earlier than version 0.10.1 and accepts SID 0x38 RequestFileTransfer messages. Affected behavior can be triggered by a short request declaring a filePathAndNameLength in the 0xFFFC-0xFFFF range.