CVE-2026-73523 in Open1722
Summary
by MITRE • 08/17/2026
COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in COVESA Open1722 versions through 0.9.2 represents a critical security flaw rooted in improper type conversion and insufficient bounds checking within the acf-can-listener component. This integer truncation issue specifically affects how error codes returned by internal functions are handled during data processing operations. The core technical failure occurs when the variable num_can_msgs, which is declared as an unsigned 8-bit integer uint8_t, receives a return value of negative one from the avtp_to_can function. In standard C programming semantics, casting a signed negative integer to an unsigned type results in wraparound behavior due two's complement representation. Consequently, the value -1 is interpreted as 255 rather than being recognized as an error condition that should halt execution or return control to the caller safely. This misinterpretation fundamentally breaks the logical flow of the application because subsequent code relies on this variable to determine how many times a loop should iterate when writing data to a stack-allocated array.
The operational impact of this flaw is severe, leading directly to an out-of-bounds write that results in sensitive information disclosure via side channels. Because the truncated value 255 exceeds the allocated size of the target stack array which contains only fifteen slots, the subsequent write loop proceeds far beyond its intended boundaries. This buffer overflow condition causes the application to read and transmit adjacent memory locations on the process stack into CAN frames. The resulting data leak exposes approximately eighteen kilobytes of internal state information from the vulnerable service. Since this data is transmitted onto the Controller Area Network bus using Automotive Video Transport Protocol streams, any device connected to that network segment can potentially capture these frames. This creates a significant risk for attackers who are able to inject malicious UDP datagrams with matching AVTP stream IDs into the system without requiring authentication.
From a threat modeling perspective, this vulnerability aligns closely with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write. The exploitation vector is classified under ATT&CK technique T1564 Hidden Window as it involves manipulating internal state to leak information, though the primary impact here is data exfiltration rather than stealthy execution. Furthermore, because the attack requires sending a rejected UDP datagram with specific parameters, it falls within the scope of remote code execution or information disclosure via network-based attacks such as those categorized under T1078 Valid Accounts if authentication were bypassed through other means, but in this case, it is strictly an unauthenticated remote vulnerability. The ability to dump stack memory allows attackers to potentially retrieve cryptographic keys, session tokens, or other sensitive data structures that reside near the affected buffer on the call stack, thereby compromising the confidentiality of the entire system running COVESA Open1722.
Mitigation strategies must focus on both immediate code fixes and broader architectural improvements. The most direct remediation involves changing the type declaration of num_can_msgs to a signed integer or explicitly checking for negative return values from avtp_to_can before proceeding with loop iterations. Developers should also implement strict bounds checking to ensure that array indices never exceed allocated limits, regardless of input values. Additionally, enabling compiler flags such as -fstack-protector-strong can help detect stack buffer overruns at runtime by inserting guard variables around local arrays. For organizations deploying this software in automotive or IoT environments, it is crucial to segment CAN bus traffic and apply network-level filtering to prevent unauthorized UDP packets from reaching the vulnerable service until patches are applied. Regular security audits focusing on type safety and error handling logic across all components interacting with external inputs will further reduce the attack surface for similar integer-related vulnerabilities.