CVE-2026-37535

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in openxc/isotp-c CAN Frame Handler

Publication date: 2026-05-01

Last updated on: 2026-05-07

Assigner: MITRE

Description

openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-01

Last Modified

2026-05-07

Generated

2026-07-06

AI Q&A

2026-05-01

EPSS Evaluated

2026-07-05

NVD

CVE-2026-37535

EUVD

EUVD-2026-26688

Affected Vendors & Products

Vendor	Product	Version / Range
openxc	isotp-c	From 5a5d19245f65189202719321facd49ce6f5d46ac (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in openxc/isotp-c up to commit 5a5d19245f65189202719321facd49ce6f5d46ac. It is an out-of-bounds read issue in the ISO-TP Single Frame receive handler. Specifically, the 4-bit payload length nibble is used directly as the size parameter for memcpy without validating it against the actual CAN data length. This means that if a malicious CAN frame contains an oversized length nibble, it can cause the program to read memory beyond the intended buffer.

Impact Analysis

The vulnerability can allow attackers to cause a denial of service by triggering out-of-bounds memory reads. Additionally, it may enable attackers to gain access to sensitive information by reading memory beyond the buffer.

Compliance Impact

The provided context and resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-37535. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70