COVESA Open1722 up to 0.9.2 CAN Listener acf-can-listener.c avtp_to_can num_can_msgs stack-based overflow

Summaryinfo

A vulnerability was found in COVESA Open1722 up to 0.9.2. It has been rated as problematic. This affects the function avtp_to_can of the file acf-can-listener.c of the component CAN Listener. Performing a manipulation of the argument num_can_msgs results in stack-based overflow. This vulnerability is reported as CVE-2026-73523. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in COVESA Open1722 up to 0.9.2. This affects the function avtp_to_can of the file acf-can-listener.c of the component CAN Listener. The manipulation of the argument num_can_msgs with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality. The summary by CVE is:

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-73523 since 08/12/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/17/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• COVESA

Name

• Open1722

Version

• 0.9.0
• 0.9.1
• 0.9.2

Website

• Product: https://github.com/COVESA/Open1722/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion