What’s Vulnerable › Vulnerabilities

CVE-2026-73522: COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-17 · updated 2026-10-23
• Weakness: CWE-121

Description

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory to achieve arbitrary code execution or denial of service.

Affected products

• COVESA Open1722: through 0.9.2

References

• https://github.com/COVESA/Open1722/issues/154
• https://www.vulncheck.com/advisories/covesa-open1722-stack-buffer-overflow-via-avtp-to-can-in-acf-can-listener

Get alerted when CVE-2026-73522 or the next vulnerability affects your stack