Is CVE-2026-42469 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42469 being exploited in the wild.

How severe is CVE-2026-42469?

High severity, with a CVSS score of 8.6, published 1 May 2026.

Which products and versions are affected?

Open Vehicles Open Vehicle Monitoring System 3 3.3.005.

Is there a fix for CVE-2026-42469?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42469 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42469?

Check whether you run Open Vehicles Open Vehicle Monitoring System 3, Openvehicles Open Vehicle Monitoring System or Openvehicles Open Vehicle Monitoring System Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42469: Open Vehicles OVMS3 stack overflow in CANswitch parser

CVE-2026-42469 · Severity: high · CVSS 8.6 · Published 2026-05-01

Open Vehicle Monitoring System 3 (OVMS3) is an open-source hardware and software platform used to monitor and control electric vehicles. A security vulnerability in its log parsing component allows an attacker to send specially crafted data frames that can crash the system or potentially allow unauthorized code execution. This could lead to a loss of vehicle monitoring capabilities or a complete system takeover.

Technologies: Openvehicles Open Vehicle Monitoring System, Openvehicles Open Vehicle Monitoring System Firmware. Vendors: Openvehicles.

Quick answers

Is CVE-2026-42469 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42469 being exploited in the wild.
How severe is CVE-2026-42469?: High severity, with a CVSS score of 8.6, published 1 May 2026.
Which products and versions are affected?: Open Vehicles Open Vehicle Monitoring System 3 3.3.005.
Is there a fix for CVE-2026-42469?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42469 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42469?: Check whether you run Open Vehicles Open Vehicle Monitoring System 3, Openvehicles Open Vehicle Monitoring System or Openvehicles Open Vehicle Monitoring System Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the 'canformat_canswitch.cpp' component of OVMS3 version 3.3.005. The vulnerability is caused by a failure to properly validate the Data Length Code (DLC) value within CANswitch frames before performing a memory copy (memcpy) into a fixed-size stack buffer. An attacker can exploit this by providing a malformed CANswitch log file or frame with an oversized DLC value. This can result in memory corruption, leading to a denial of service (system crash) or potential remote code execution. The attack can be carried out over the network without requiring authentication.

Affected products

Open Vehicles Open Vehicle Monitoring System 3 (OVMS3) 3.3.005

Timeline

2026-04-30: disclosed: Initial disclosure by Innora Security Research
2026-05-01: advisory: CVE published and CVSS assigned by CISA-ADP
2026-05-06: other: Issue tracked by maintainers on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.