CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation
Remote attackers can leak stack memory onto the CAN bus via integer truncation in COVESA Open1722, exposing sensitive process data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73523?
CVE-2026-73523 is a high-severity vulnerability in COVESA Open1722, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.
Weakness: CWE-197
Which versions are affected by CVE-2026-73523?
How do I fix CVE-2026-73523?
No fix has been published for CVE-2026-73523 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73523 being exploited?
There is no known exploitation of CVE-2026-73523 in the wild and no public exploit code.
Sources
Also known as GHSA-ggx8-w5hw-4h29.