Read the docs
TI-2026-28060 Aliases CVE-2026-37532GHSA-h5cx-4fh7-xq44

AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the…

Priority LOW 31CWE-126Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00232 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:*up to 17.1.12Vulnerablebackstage
  • cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:* Versions up to 17.1.12 Vulnerable ·backstage

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-37532
  2. 2026-10-03 Alias added: GHSA-h5cx-4fh7-xq44

References

Advisory 1

Other 1

  • TI-2026-28059 AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2026-28058 AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c… CVSS 3.1HIGH 7.5
  • TI-2026-28057 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to… CVSS 3.1HIGH 7.8
  • TI-2026-28056 AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences