Is CVE-2026-91141 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91141 being exploited in the wild.

How severe is CVE-2026-91141?

Informational severity, published 12 November 2026.

Which products and versions are affected?

COVESA Vsomeip 3.7.3 and earlier.

How is CVE-2026-91141 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91141?

Check whether you run COVESA Vsomeip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91141: COVESA vsomeip memory exhaustion in TCP endpoint buffer

CVE-2026-91141 · Severity: info · Published 2026-11-12

vsomeip is middleware used in vehicles and embedded systems to enable communication between software services over the SOME/IP protocol. An attacker with access to the network can send a small TCP packet with a falsely declared message size, causing the system to allocate up to 4 GB of RAM per connection. On systems with limited memory, this triggers an immediate crash; on larger systems, sustained attacks exhaust all available memory and deny service.

Quick answers

Is CVE-2026-91141 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91141 being exploited in the wild.
How severe is CVE-2026-91141?: Informational severity, published 12 November 2026.
Which products and versions are affected?: COVESA Vsomeip 3.7.3 and earlier.
Is there a fix for CVE-2026-91141?: Yes: fixed in vsomeip 3.7.4. Until then: Configure an explicit max-payload-size-reliable limit appropriate to the service in the vsomeip configuration, or restrict TCP access to reliable SOME/IP endpoints to trusted networks and authorized peers only. Monitor for anomalous memory growth and repeated unexpected TCP connections to SOME/IP ports. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91141 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91141?: Check whether you run COVESA Vsomeip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: vsomeip 3.7.4

Configure an explicit max-payload-size-reliable limit appropriate to the service in the vsomeip configuration, or restrict TCP access to reliable SOME/IP endpoints to trusted networks and authorized peers only. Monitor for anomalous memory growth and repeated unexpected TCP connections to SOME/IP ports.

Technical details

The vulnerability exists in the reliable TCP endpoint buffer handling: vsomeip reads a 32-bit length field from the SOME/IP header and pre-allocates a receive buffer of that size before receiving the payload, without validating the declared size when the default unlimited message size is in effect. No authentication or valid message content is required—a single 16-byte header is sufficient. The allocation is per connection and released only when the connection closes, allowing repeated connections to exhaust memory. The fix, released in version 3.7.4, introduces a 10 MiB default limit and validates sizes before allocation.

Affected products

COVESA vsomeip 3.7.3 and earlier

Timeline

2026-02-26: disclosed: Issue publicly reported as COVESA/vsomeip issue #1009
2026-07-06: patched: Fix released in vsomeip 3.7.4
2026-10-26: advisory: CERT/CC published VU#128947

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.