Integer Underflow and Out-of-Bounds Read in Driftregion ISO14229 Product

CVE-2026-54413

What is CVE-2026-54413?

The Driftregion ISO14229 product contains a vulnerability that stems from an integer underflow and a downstream out-of-bounds read condition in the Handle_0x27_SecurityAccess function. An unauthenticated remote attacker can exploit this by sending a specially crafted single-byte SecurityAccess request, which can lead to the crashing of a UDS server and potential unauthorized access to memory beyond the expected buffer limit. This flaw occurs because the function mishandles the length of the received message, allowing the assessment of excessive bytes from the receive buffer. This weakness exposes deployments within automotive ECUs, industrial control systems, and IoT devices that utilize ISO14229 as their UDS server, highlighting critical security implications for these environments.

References