CVE-2026-54413: driftregion iso14229 DoS Vulnerability

CVE-2026-54413 Overview

CVE-2026-54413 is an integer underflow vulnerability in the driftregion/iso14229 Unified Diagnostic Services (UDS) library through version 0.9.0. The flaw resides in Handle_0x27_SecurityAccess() inside iso14229.c and triggers a downstream out-of-bounds read. A remote unauthenticated attacker can crash a UDS server and potentially read memory past the 4-KB receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. The vulnerable handler is reachable over Controller Area Network (CAN) bus, On-Board Diagnostics II (OBD-II), ISO-TP, and Diagnostics over Internet Protocol (DoIP) transports.

Critical Impact
Unauthenticated attackers can crash UDS servers on automotive Electronic Control Units (ECUs), industrial controllers, and IoT devices, with potential disclosure of up to 65,535 bytes of process memory.

Affected Products

driftregion/iso14229 versions through 0.9.0
Automotive ECUs shipping iso14229 as their UDS server
Industrial controllers and IoT devices embedding the iso14229 library

Discovery Timeline

2026-06-14 - CVE-2026-54413 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54413

Vulnerability Analysis

The Handle_0x27_SecurityAccess() function reads the SecurityAccess subFunction byte from recv_buf[1] without first validating that recv_len is at least 2. The handler then computes the key-data length using the unsigned subtraction (uint16_t)(recv_len - UDS_0X27_REQ_BASE_LEN). When recv_len equals 1, the subtraction underflows to 65535. This attacker-controlled length is passed as args.len into the application's SecAccessValidateKey or SecAccessRequestSeed callback. The callback typically iterates or copies that many bytes from the 4-KB receive buffer, producing an out-of-bounds read that spans approximately 61 KB of adjacent memory.

Root Cause

The defect is a missing lower-bound length check classified under CWE-125 Out-of-Bounds Read and CWE-191 Integer Underflow. Every other UDS sub-function handler in the library, including 0x10, 0x11, 0x14, 0x19, 0x22, 0x23, and 0x28, performs an explicit recv_len lower-bound check before indexing. Handle_0x27_SecurityAccess is the sole outlier, as documented in the GitHub iso14229 source code.

Attack Vector

The handler is exposed in the default diagnostic session without prior authentication. An attacker first sends any well-formed 0x27 SecurityAccess request to establish handler state, then transmits a single-byte 0x27 follow-up message. The transport may be CAN bus, OBD-II, ISO-TP, or DoIP, meaning network-adjacent and remote attackers can both reach the vulnerable code path. No verified public exploit code is available at the time of publication. Refer to the driftregion iso14229 repository for the affected source.

Detection Methods for CVE-2026-54413

Indicators of Compromise

UDS server processes terminating after receiving short 0x27 SecurityAccess requests
CAN, ISO-TP, or DoIP traffic captures showing a 0x27 request followed by a one-byte 0x27 frame
Diagnostic logs reporting negative response codes or callback errors tied to SecAccessRequestSeed or SecAccessValidateKey

Detection Strategies

Inspect ISO-TP and DoIP payloads for 0x27 Service Identifier (SID) messages with a payload length of exactly 1 byte
Instrument Handle_0x27_SecurityAccess to log recv_len values below UDS_0X27_REQ_BASE_LEN
Apply static analysis tooling to flag unsigned subtractions performed before length validation

Monitoring Recommendations

Forward ECU and gateway diagnostic logs to a centralized Security Information and Event Management (SIEM) platform for correlation
Monitor DoIP TCP port 13400 and UDP port 13400 for malformed SecurityAccess sequences
Alert on repeated UDS server restarts or watchdog resets on production ECUs

How to Mitigate CVE-2026-54413

Immediate Actions Required

Inventory firmware images and embedded systems that link against driftregion/iso14229 at version 0.9.0 or earlier
Restrict DoIP and OBD-II access to authenticated diagnostic clients on isolated vehicle or operational technology networks
Disable the SecurityAccess service in default diagnostic sessions where vendor functionality permits

Patch Information

No fixed release is referenced in the NVD data at the time of writing. Maintainers and integrators should add an explicit recv_len >= UDS_0X27_REQ_BASE_LEN check at the entry of Handle_0x27_SecurityAccess, mirroring the validation performed by the other UDS sub-function handlers. Track the upstream iso14229 GitHub repository for fix commits.

Workarounds

Apply a local source patch that returns the UDS negative response incorrectMessageLengthOrInvalidFormat (0x13) when recv_len < 2 for SID 0x27
Filter inbound CAN, ISO-TP, and DoIP frames at gateway ECUs to drop 0x27 requests shorter than 2 bytes
Enforce network segmentation between in-vehicle infotainment, telematics, and powertrain buses to limit reachability of vulnerable UDS endpoints

bash

# Configuration example: gateway filter pseudocode to drop malformed 0x27 frames
if frame.sid == 0x27 and frame.payload_len < 2:
    drop_frame(frame)
    log_event("CVE-2026-54413 candidate frame dropped", frame.source)