CVE-2026-74238 in Nebula
Summary
by MITRE • 08/17/2026
TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in TIER IV Nebula versions through 1.2.0 represents a critical security flaw within the Vlp32Decoder::unpack() function, specifically categorized as an out-of-bounds read. This issue arises when the software processes incoming UDP datagrams from Velodyne LiDAR sensors without adequate validation of packet length against buffer boundaries. The core technical failure lies in the decoder's inability to verify that the received data payload is sufficient before attempting to parse it into point cloud structures. When an attacker sends a short or malformed UDP datagram to the specific sensor port, the decoding logic proceeds to access memory locations beyond the allocated buffer size. This behavior constitutes a classic heap-based out-of-bounds read, where the application reads adjacent heap memory that was not intended for this operation, potentially exposing sensitive data stored in those memory regions.
The operational impact of this vulnerability is significant due to the specific network configuration and integration context of the Nebula driver. Unlike other drivers that may enforce sender-address restrictions or stricter packet validation, the Velodyne UDP sensor port handled by this component lacks such safeguards against unauthenticated remote access. This architectural oversight allows any entity with network connectivity to interact directly with the decoding process. By exploiting this flaw, an attacker can force the system to publish fabricated point cloud data into downstream PointCloud2 messages. These maliciously crafted points are then consumed by Autoware nodes, which rely on accurate sensor input for navigation and obstacle detection. The injection of false spatial data can lead to severe consequences in autonomous driving scenarios, including misinterpretation of the environment, potential collision hazards, or system instability due to unexpected data formats being processed by downstream algorithms.
From a classification perspective, this vulnerability aligns with CWE-125, which describes out-of-bounds read vulnerabilities where software reads past the end of an allocated buffer. The exploitation vector is further characterized under MITRE ATT&CK techniques related to remote code execution or information disclosure via memory corruption, although in this specific instance, the primary risk stems from data integrity compromise rather than direct command execution. The lack of input validation on network-facing components highlights a common pitfall in embedded and autonomous systems where performance optimization often leads to insufficient boundary checks. To mitigate this risk, developers must implement strict length verification within the Vlp32Decoder::unpack() function before any memory access occurs. Additionally, enforcing sender-address restrictions similar to those present in other drivers would significantly reduce the attack surface by limiting exposure to trusted sources only. Regular security audits focusing on network packet handling and buffer management are essential to prevent such vulnerabilities from persisting in safety-critical autonomous driving software stacks.