Executive brief
COVESA Open1722 is a networking library used to transport automotive CAN bus messages over Ethernet. A stack buffer overflow in the avtp_to_can() function allows unauthenticated attackers on the network to corrupt memory and crash the application or potentially execute arbitrary code by sending specially crafted network packets containing more CAN messages than the application expects.
Technical details
The vulnerability is a classic stack-based buffer overflow (CWE-121) in the avtp_to_can() function within examples/acf-can/acf-can-common.c. The function accepts AVTP PDUs and decodes them into a fixed 15-slot stack array (can_frames), but increments a write index without validating it against the array capacity. An attacker can send a single UDP datagram over the network containing more than 15 ACF-CAN messages to overflow the stack array. The listener accepts datagrams matching a hardcoded, plaintext stream ID (0xAABBCCDDEEFF0001) with no authentication or integrity checking. Successful exploitation corrupts adjacent stack memory, potentially allowing arbitrary code execution or denial of service. No authentication or user interaction is required; the attack is network-reachable and can be triggered by sending a single UDP packet.
Affected products
- COVESA Open1722 through 0.9.2
Timeline
- 2026-08-17: disclosed: CVE-2026-73522 published on NVD