Integer Truncation in COVESA Open1722 Leads to CAN Bus Memory Leak

Executive Summary

CVE-2026-73523 is an integer truncation vulnerability in COVESA Open1722 through version 0.9.2. It occurs in the acf-can-listener.c component where a uint8_t variable named num_can_msgs incorrectly truncates the -1 error return value from avtp_to_can() to 255. This causes a loop to write 255 times over a 15-slot stack array, leaking approximately 18 KB of adjacent stack memory as roughly 240 CAN frames onto the CAN bus.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring CAN bus traffic for unexpected frames. Use tools like candump to capture CAN frames and look for unusually large bursts of messages (around 240 frames) from the acf-can-listener process. Check for memory-like patterns in the payload data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to leak sensitive stack memory onto the CAN bus. The leaked memory could contain sensitive data such as encryption keys, passwords, or other confidential information. Attackers can use this to gain unauthorized access, escalate privileges, or perform further attacks on the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, exposing sensitive personal or health information. Under GDPR, this may result in significant fines for failing to protect personal data. For HIPAA, it could violate safeguards for protected health information, leading to penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update to the latest version of Open1722 beyond 0.9.2. If unavailable, apply the patch making num_can_msgs an int and adding bounds checking in acf-can-listener.c. Disable the acf-can-listener service if not critical. Monitor CAN bus traffic for suspicious activity.

Useful 0 Not Useful 0