CVE-2026-74238
Received Received - Intake

TIER IV Nebula UDP Buffer Out-of-Bounds Read Vulnerability

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74238
EUVD
EUVD-2026-60323

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tier_iv nebula to 1.2.0 (inc)
tier_iv nebula to 1.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74238 is an out-of-bounds read vulnerability in TIER IV Nebula through version 1.2.0. It occurs in the Vlp32Decoder::unpack() function when processing Velodyne UDP sensor data. The decoder casts incoming datagrams to a fixed 1206-byte structure without validating length. Short datagrams cause the decoder to read past the buffer into adjacent heap memory, fabricating point cloud data from memory contents. This affects downstream Autoware nodes consuming PointCloud2 messages.

Detection Guidance

Monitor network traffic for short UDP datagrams sent to the Velodyne UDP sensor port used by Nebula. Check for unexpected PointCloud2 messages containing fabricated points derived from heap memory. Inspect logs for crashes or anomalies in the Vlp32Decoder::unpack() function.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to inject fabricated point cloud data into systems using Nebula with Velodyne sensors. The injected data could mislead navigation, perception, or decision-making systems relying on point cloud inputs. While the system may not crash, incorrect sensor data could lead to operational errors in autonomous systems or applications processing the point clouds.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it involves data integrity issues in sensor data processing rather than unauthorized data access or exposure. However, it could indirectly affect compliance by potentially corrupting data used in systems handling sensitive information, leading to incorrect processing or decisions based on fabricated sensor inputs.

Mitigation Strategies

Apply the patch adding length checks in Vlp32Decoder::unpack() and limit the UDP socket to the sender address. Update to the latest version of Nebula. Restrict network access to the Velodyne UDP port if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart