CVE-2026-37534 Integer overflow in n/a
Attackers can achieve arbitrary memory writes and potential code execution via crafted CAN frames exploiting an integer underflow in the SAE J1939 library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-37534?
CVE-2026-37534 is a critical vulnerability in n/a, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transport_Protocol_Data_Transfer,allows attackers to write to arbitrary memory via crafted sequence number from the CAN frame.
Weakness: CWE-191
Which versions are affected by CVE-2026-37534?
How do I fix CVE-2026-37534?
No fix has been published for CVE-2026-37534 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-37534 being exploited?
There is no known exploitation of CVE-2026-37534 in the wild and no public exploit code.
Sources
Also known as GHSA-mf4w-cwh4-g24v.