CVE-2026-37535: openxc/isotp-c Out-of-Bounds DoS Flaw

CVE-2026-37535 Overview

CVE-2026-37535 is an out-of-bounds read vulnerability in the openxc/isotp-c library, an ISO-TP (ISO 15765-2) implementation used to layer transport-protocol messaging over Controller Area Network (CAN) frames. The flaw resides in the Single Frame receive handler in src/isotp/receive.c. The handler uses the 4-bit payload length nibble from the incoming CAN frame as the memcpy size without validating it against the actual CAN data length. An attacker on the adjacent CAN bus can craft a Single Frame with an oversized length nibble to read memory beyond the input buffer. The condition affects the project through commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09).

Critical Impact
A malicious CAN frame can trigger out-of-bounds memory reads, leading to denial of service or disclosure of adjacent memory contents on devices that integrate the isotp-c library.

Affected Products

openxc/isotp-c library through commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09)
Embedded firmware and automotive/IoT components that link isotp-c for ISO-TP message handling
Diagnostic and telematics tooling that processes untrusted CAN traffic via isotp-c

Discovery Timeline

2026-05-01 - CVE-2026-37535 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-37535

Vulnerability Analysis

ISO-TP encodes its Protocol Control Information (PCI) in the first byte of the CAN payload. For a Single Frame, the upper nibble identifies the frame type and the lower 4-bit nibble (SF_DL) declares the payload length, which can range from 0 through 7 on classical CAN. The isotp-c Single Frame receive handler reads this nibble and passes it directly to memcpy as the copy length, sourcing data from the inbound CAN frame buffer. Because the handler does not cross-check SF_DL against the actual number of CAN data bytes received, a frame that declares a length larger than the bytes physically present causes the copy to read past the end of the input buffer. The defect is classified under CWE-125: Out-of-Bounds Read. Consequences include process or device crash from invalid reads and disclosure of stack or heap contents that follow the CAN buffer in memory.

Root Cause

The root cause is missing input validation on the Single Frame length nibble in src/isotp/receive.c. The handler trusts the attacker-controlled SF_DL field and omits a bounds check against the received CAN frame's actual data length. Any value up to 0x0F can be written into the length nibble, but the receive path does not clamp or reject lengths exceeding the available payload bytes before invoking memcpy.

Attack Vector

Exploitation requires the attacker to inject a single crafted CAN frame onto a bus that the vulnerable isotp-c instance reads. The attack vector is adjacent network access to the CAN segment, with no authentication or user interaction required. Typical access scenarios include a compromised peripheral electronic control unit, an OBD-II dongle, or a connected diagnostic tool with bus access. The attacker sets the high nibble of the first payload byte to indicate a Single Frame and the low nibble to a length larger than the bytes actually transmitted, causing the receive handler to copy memory beyond the frame buffer. A proof-of-concept is published as a GitHub Gist, and the vulnerable source is available in the openxc/isotp-c repository.

Detection Methods for CVE-2026-37535

Indicators of Compromise

CAN Single Frames where the low nibble of byte 0 exceeds the frame's actual data length, for example a PCI byte of 0x07 carried in a CAN frame with a Data Length Code below 8.
Repeated process crashes, watchdog resets, or segmentation faults in firmware components that link isotp-c.
Unexpected diagnostic responses or memory-like byte patterns appearing in ISO-TP payloads forwarded to upper-layer handlers.

Detection Strategies

Add a bus-side validator that compares the Single Frame SF_DL nibble against the CAN frame's reported data length and flags or drops mismatches.
Perform binary or source-level scanning of firmware images for the vulnerable isotp-c commit hash 5a5d19245f65189202719321facd49ce6f5d46ac and earlier revisions of receive.c.
Fuzz the ISO-TP receive path with malformed Single Frames in lab environments to identify components that fail to reject oversized length nibbles.

Monitoring Recommendations

Enable CAN intrusion detection on vehicle and industrial networks to log anomalous Single Frame PCI values.
Forward firmware crash logs and watchdog events to a centralized SIEM and alert on repeated faults in ISO-TP processing components.
Track software bills of materials (SBOMs) to identify all products that embed openxc/isotp-c and prioritize them for monitoring.

How to Mitigate CVE-2026-37535

Immediate Actions Required

Inventory all firmware and applications that include openxc/isotp-c and identify the integrated commit hash.
Restrict physical and logical access to CAN buses where vulnerable handlers are deployed, including OBD-II ports and diagnostic gateways.
Deploy a CAN gateway or filter that validates ISO-TP Single Frame length nibbles before forwarding traffic to vulnerable endpoints.

Patch Information

No upstream fix is referenced in the NVD entry at the time of publication. Maintainers and downstream integrators should apply a patch in src/isotp/receive.c that validates the Single Frame SF_DL nibble against the received CAN frame's data length and rejects frames where SF_DL exceeds the available bytes. Rebuild and redeploy any firmware that statically links the library. Track the openxc/isotp-c repository for upstream remediation commits.

Workarounds

Implement a wrapper around the ISO-TP receive entry point that drops Single Frames whose length nibble exceeds the actual CAN payload size.
Disable or gate ISO-TP processing on interfaces that do not require it, particularly externally reachable buses.
Apply network segmentation between untrusted peripherals and electronic control units that run the vulnerable handler.

bash

# Example: drop ISO-TP Single Frames with inconsistent length using SocketCAN filters and a userspace validator
# (illustrative — adapt to target platform)
cansniffer -c can0 | awk '/^ can0/ { pci=strtonum("0x" substr($3,1,1)); sf_dl=strtonum("0x" substr($3,2,1)); dlc=$2+0; if (pci==0 && sf_dl > dlc-1) print "DROP malformed SF:", $0 }'