CVE-2026-73522: COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener
COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtptocan() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory to achieve arbitrary code execution or denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73522?
CVE-2026-73522 has a high severity rating of 8.7.
What type of vulnerability is associated with CVE-2026-73522?
CVE-2026-73522 is classified as a stack buffer overflow vulnerability in COVESA Open1722.
How can I exploit CVE-2026-73522?
An attacker can exploit CVE-2026-73522 by sending a crafted UDP datagram containing more than 15 ACF-CAN messages to the vulnerable system.
What systems are affected by CVE-2026-73522?
CVE-2026-73522 affects COVESA Open1722 versions up to and including 0.9.2.
How do I fix CVE-2026-73522?
To fix CVE-2026-73522, update COVESA Open1722 to the latest version that addresses the buffer overflow vulnerability.