Integer Truncation Vulnerability in COVESA Open1722 CAN Listener

CVE-2026-73523

What is CVE-2026-73523?

The COVESA Open1722 product versions up to 0.9.2 exhibit an integer truncation vulnerability in the acf-can-listener.c file. This flaw allows unauthenticated remote attackers to exploit the CAN listener by sending a specially crafted UDP datagram with a matching AVTP stream ID. The vulnerability arises from the 'num_can_msgs' variable, which is declared as uint8_t, leading it to truncate the error return value from the avtp_to_can function. This truncation can result in significant issues as it allows a write loop to process up to 255 iterations over a limited stack memory space, causing approximately 18 KB of sensitive stack memory to be leaked as roughly 240 CAN frames to any recipient on the CAN bus.

References