CVE-2026-74238: TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder
TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TIER IV Nebula Vlp32Decoder (VLP32 UDP decoder)to a version that resolves this vulnerability.Fixed in 1.2.0 - Compensating control
Apply network controls to the Velodyne UDP sensor port used by the Nebula VLP32 UDP decoder to prevent unauthenticated remote attackers from sending malformed short UDP datagrams (e.g., restrict access to trusted sender IPs at the firewall/ACL).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74238?
The severity of CVE-2026-74238 is classified as high with a score of 7.5.
How do I fix CVE-2026-74238?
To fix CVE-2026-74238, update TIER IV Nebula to the latest version that addresses this heap out-of-bounds read vulnerability.
What type of attack does CVE-2026-74238 enable?
CVE-2026-74238 allows unauthenticated remote attackers to read past the end of a received UDP buffer into adjacent heap memory.
Is CVE-2026-74238 exploitable without authentication?
Yes, CVE-2026-74238 can be exploited by unauthenticated attackers.
What component is affected by CVE-2026-74238?
The vulnerability affects the Vlp32Decoder::unpack() function in TIER IV Nebula version 1.2.0.