Is CVE-2026-37530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37530 being exploited in the wild.

How severe is CVE-2026-37530?

High severity, with a CVSS score of 7.5, published 1 May 2026.

Which products and versions are affected?

Automotive Grade Linux AGL Service CAN Low Level up to and including 17.1.12.

Is there a fix for CVE-2026-37530?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37530 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-37530?

Check whether you run Automotive Grade Linux AGL Service CAN Low Level or Linuxfoundation Automotive Grade Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37530: Automotive Grade Linux agl-service-can-low-level stack overflow in uds-c

CVE-2026-37530 · Severity: high · CVSS 7.5 · Published 2026-05-01

A vulnerability exists in the low-level CAN bus service of Automotive Grade Linux, a platform used in vehicle infotainment and instrument clusters. This flaw allows an attacker to send specially crafted diagnostic requests that can crash the service or potentially take control of the underlying system. Such an exploit could disrupt vehicle operations or compromise the security of the automotive electronic control units (ECUs).

Technologies: Linuxfoundation Automotive Grade Linux. Vendors: Automotive Grade Linux, Linuxfoundation.

Quick answers

Is CVE-2026-37530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37530 being exploited in the wild.
How severe is CVE-2026-37530?: High severity, with a CVSS score of 7.5, published 1 May 2026.
Which products and versions are affected?: Automotive Grade Linux AGL Service CAN Low Level up to and including 17.1.12.
Is there a fix for CVE-2026-37530?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37530 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-37530?: Check whether you run Automotive Grade Linux AGL Service CAN Low Level or Linuxfoundation Automotive Grade Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the uds-c library used by agl-service-can-low-level through version 17.1.12. The 'send_diagnostic_request' function in 'uds.c' allocates a 6-byte stack buffer but performs a memcpy of up to 7 bytes based on the 'payload_length' field without performing bounds checking. This results in a controlled stack overflow of 1-4 bytes. On 32-bit ARM automotive ECUs lacking stack canaries, this vulnerability can be exploited to overwrite the return address and achieve remote code execution (RCE). The issue is reachable over the network via the CAN service API.

Affected products

Automotive Grade Linux agl-service-can-low-level up to and including 17.1.12

Timeline

2026-04-30: disclosed: Initial disclosure by Innora Security Research
2026-05-01: advisory: CVE-2026-37530 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.