Is CVE-2026-42468 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42468 being exploited in the wild.

How severe is CVE-2026-42468?

High severity, with a CVSS score of 8.8, published 1 May 2026.

Which products and versions are affected?

Open Vehicles Open Vehicle Monitoring System 3 firmware 3.3.005.

Is there a fix for CVE-2026-42468?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42468 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-42468?

Check whether you run Open Vehicles Open Vehicle Monitoring System 3 firmware, Openvehicles Open Vehicle Monitoring System or Openvehicles Open Vehicle Monitoring System Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42468: Open Vehicles OVMS3 stack overflow in PCAP log parser

CVE-2026-42468 · Severity: high · CVSS 8.8 · Published 2026-05-01

Open Vehicle Monitoring System 3 (OVMS3) is a hardware and software platform used to monitor and control electric vehicles remotely. A security vulnerability exists in how the system processes network traffic log files (PCAP format). An attacker could provide a specially crafted log file that, when processed by the system, causes a crash or allows for unauthorized code execution, potentially compromising the vehicle's monitoring data or system integrity.

Technologies: Openvehicles Open Vehicle Monitoring System, Openvehicles Open Vehicle Monitoring System Firmware. Vendors: Openvehicles.

Quick answers

Is CVE-2026-42468 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42468 being exploited in the wild.
How severe is CVE-2026-42468?: High severity, with a CVSS score of 8.8, published 1 May 2026.
Which products and versions are affected?: Open Vehicles Open Vehicle Monitoring System 3 firmware 3.3.005.
Is there a fix for CVE-2026-42468?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42468 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-42468?: Check whether you run Open Vehicles Open Vehicle Monitoring System 3 firmware, Openvehicles Open Vehicle Monitoring System or Openvehicles Open Vehicle Monitoring System Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005 within the 'canformat_pcap.cpp' component. The vulnerability is caused by a lack of proper validation for the 'phdr.len' field in the PCAP/pcapng log format parser. When processing a malformed log file, this length field is used in a 'memcpy' operation into a fixed-size stack buffer without an upper-bound check. An attacker can exploit this by providing a crafted PCAP file, leading to a denial of service (system crash) or potential arbitrary code execution. The attack requires user interaction to trigger the parsing of the malicious file.

Affected products

Open Vehicles Open Vehicle Monitoring System 3 (OVMS3) firmware 3.3.005

Timeline

2026-04-30: disclosed: Initial disclosure by Innora Security Research
2026-05-01: advisory: CVE published
2026-05-06: other: Issue tracked by vendor on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.