Executive brief
TIER IV Nebula is a driver library for Velodyne LiDAR sensors used in autonomous vehicle platforms like Autoware. An attacker on the network can send a malformed UDP packet to the sensor port, causing the decoder to read memory beyond the packet boundary. Rather than crashing, the decoder silently publishes fabricated 3D point data derived from heap memory into the vehicle's perception system, potentially corrupting sensor feeds that downstream safety-critical nodes depend on.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the Vlp32Decoder::unpack() function. The decoder casts an incoming UDP datagram directly to a fixed 1206-byte packet structure without validating that the received buffer is actually that size. When a shorter datagram arrives, the decoder indexes into memory beyond the buffer boundary while parsing the packet. The Velodyne UDP socket is configured without sender-address restrictions, allowing any network-accessible attacker to send malformed datagrams. The bug does not cause a crash; instead, the decoder treats the out-of-bounds memory reads as valid sensor points and publishes them into PointCloud2 messages consumed by safety-critical autonomous driving nodes. A fix pattern already exists in-tree (the Hesai decoder validates packet length); the recommended remediation is to reject packets that don't match the expected 1206-byte size.
Affected products
- TIER IV Nebula through 1.2.0
Timeline
- 2026-08-17: disclosed
- 2026-08-17: other: CVE-2026-74238 assigned