Read the docs
TI-2026-51627 Aliases CVE-2026-73523GHSA-ggx8-w5hw-4h29

COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

Priority MEDIUM 44CWE-197Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
COVESAOpen1722up to 0.9.2—No fix listedCNA
  • Open1722 VendorCOVESA Affected up to 0.9.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73523
  2. 2026-10-03 Alias added: GHSA-ggx8-w5hw-4h29

References

Other 1

  • TI-2023-11420 An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly… CVSS 3.1HIGH 7.5
  • TI-2024-03712 COVESA vsomeip race condition CVSS 3.1MEDIUM 4.4
  • TI-2026-51626 COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener CVSS 4.0HIGH 8.7
  • TI-2023-18207 Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences