Description

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory to achieve arbitrary code execution or denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T18:18:14.030Z",
  "pubdate": "2026-08-17T18:18:14.030Z",
  "executiveSummary": "COVESA Open1722 versions through 0.9.2 suffer from a critical stack buffer overflow vulnerability residing in the AVTP-to-CAN conversion logic. This security defect allows unauthenticated remote attackers to send crafted UDP datagrams containing an excessive number of ACF-CAN messages, exceeding the bounds of a fixed 15-slot stack array.\nSuccessful exploitation of this vulnerability permits remote attackers to corrupt adjacent stack memory, leading to potential arbitrary code execution or a localized denial of service condition. The attack surface is exposed over the network, accepting incoming datagrams from any sender that matches a hardcoded, unauthenticated stream ID transmitted in plaintext.\nThe combination of network exposure, lack of authentication, and memory corruption primitives presents a severe risk to affected automotive and embedded systems utilizing the Open1722 protocol stack. Mitigation requires proper bounds checking within the affected parsing routines and improved stream validation mechanisms.",
  "technicalDetails": "The vulnerability exists within the AVTP parsing and handling implementation of COVESA Open1722 through version 0.9.2, specifically inside the avtp_to_can() function responsible for translating AVTP Control Format (ACF) messages into CAN frames.\nThe root cause of the vulnerability is an absence of strict bounds checking on the write index relative to the caller-supplied fixed-size stack array. The stack array is statically allocated to hold a maximum of 15 ACF-CAN messages. However, the avtp_to_can() function continuously increments its internal write index as it processes incoming payloads without validating whether the current index exceeds the maximum capacity of the 15-slot array.\nExploitation occurs when an unauthenticated remote attacker transmits a malicious UDP datagram encapsulating more than 15 ACF-CAN messages. Because the listener implementation accepts datagrams from any arbitrary network sender provided the packet matches a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can easily forge or replay valid stream traffic.\nAs the parsing loop iterates over the malicious datagram, the lack of boundary validation causes the function to write past the boundaries of the fixed stack buffer. This results in the systematic overwriting of adjacent stack memory structures, including saved frame pointers and return addresses.\nThe post-exploitation impact includes the potential hijacking of the instruction pointer to achieve arbitrary code execution within the context of the running application, or memory corruption leading to application crashes and denial of service. No prior authentication, special privileges, or complex local access are required, as the attack vector is fully exploitable remotely over the network layer."
}