CVE-2026-73522
Received Received - Intake

Stack Buffer Overflow in COVESA Open1722

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory to achieve arbitrary code execution or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-73522
EUVD
EUVD-2026-60316

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
covesa open1722 0.9.2
covesa open1722 to 0.9.2 (exc)
covesa open1722 to 0.9.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73522 is a stack-based buffer overflow in COVESA Open1722 through version 0.9.2. The avtp_to_can() function in the acf-can-listener component fails to validate the write index against a fixed 15-slot stack array. Attackers can send a crafted UDP datagram with more than 15 ACF-CAN messages to overwrite adjacent stack memory, enabling arbitrary code execution or denial of service.

Detection Guidance

To detect this vulnerability, monitor network traffic for UDP datagrams targeting the Open1722 service. Look for malformed ACF-CAN messages exceeding 15 messages per datagram. Use packet inspection tools like tcpdump or Wireshark to capture and analyze UDP traffic on the relevant port.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to execute arbitrary code or cause denial of service on systems running vulnerable versions of COVESA Open1722. Since the attack is network-based and does not require authentication, any exposed instance of the software could be targeted.

Compliance Impact

This vulnerability enables arbitrary code execution or denial of service due to stack memory corruption, which could lead to unauthorized data access, modification, or deletion. Such impacts may violate GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information if exploited in systems handling regulated data.

Mitigation Strategies

Immediately update COVESA Open1722 to a patched version if available. If not, restrict network access to the Open1722 service by blocking UDP traffic to the affected port. Implement firewalls or network segmentation to limit exposure. Monitor for unusual activity or crashes in the Open1722 service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73522. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart