What’s Vulnerable › Vulnerabilities

CVE-2026-74238: TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-17 · updated 2026-10-23
• Weakness: CWE-125

Description

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.

Affected products

• tier4 nebula: through 1.2.0

References

• https://github.com/tier4/nebula/issues/488
• https://www.vulncheck.com/advisories/tier-iv-nebula-heap-out-of-bounds-read-via-vlp32-udp-decoder

Get alerted when CVE-2026-74238 or the next vulnerability affects your stack