Read the docs
TI-2026-28058 Aliases CVE-2026-37530GHSA-grgw-7h7j-hjqm

AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c…

Priority LOW 39CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) but copies up to 7 bytes (MAX_UDS_REQUEST_PAYLOAD_LENGTH=7) via memcpy at an offset of 1+pid_length (2-3 bytes), resulting in 1-4 bytes of controlled stack overflow. The payload_length field (uint8_t) has no bounds check against the destination buffer. On 32-bit ARM automotive ECUs without stack canaries, this can lead to return address overwrite and RCE.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:*up to 17.1.12Vulnerablebackstage
  • cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:* Versions up to 17.1.12 Vulnerable ·backstage

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-37530
  2. 2026-10-03 Alias added: GHSA-grgw-7h7j-hjqm
  3. 2026-10-25 Priority changed: MEDIUM → LOW

References

Advisory 1

Other 1

  • TI-2026-28059 AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2026-28057 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to… CVSS 3.1HIGH 7.8
  • TI-2026-28056 AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation… CVSS 3.1HIGH 7.8
  • TI-2026-28060 AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the… CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences