CVE-2026-67560: Bendix EC80 Brake ECU Buffer Overflow

CVE-2026-67560 Overview

CVE-2026-67560 is a stack-based buffer overflow [CWE-121] in the Bendix EC80 Brake Electronic Control Unit (ECU). An attacker on an adjacent network can send a crafted payload to crash the ECU. The same condition can be used to execute arbitrary code or inject arbitrary Controller Area Network (CAN) bus traffic. Successful exploitation may result in loss of the Anti-lock Braking System (ABS) function, steering assist, speedometer, and shifting on affected vehicles. The vulnerability was disclosed through a CISA Industrial Control Systems advisory.

Critical Impact
Remote code execution and arbitrary CAN bus injection against a safety-critical vehicle brake controller, with potential loss of ABS, steering assist, speedometer, and shifting functions.

Affected Products

Bendix EC80 Brake ECU
Commercial vehicles integrating the Bendix EC80 controller on the CAN bus
Fleet systems exposing vehicle networks to adjacent-network access

Discovery Timeline

2026-08-28 - CVE-2026-67560 published to the National Vulnerability Database
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-67560

Vulnerability Analysis

The Bendix EC80 Brake ECU contains a stack-based buffer overflow reachable through messages processed by the controller. Data received from the vehicle network is copied into a fixed-size stack buffer without adequate bounds checking. An oversized input overwrites adjacent stack memory, including saved return addresses and control data.

At minimum, the corruption crashes the ECU and removes brake control logic from the vehicle network. A precisely crafted payload can hijack execution flow inside the ECU firmware and run attacker-controlled code. Once code execution is achieved, the attacker can transmit arbitrary CAN bus frames from a trusted safety controller, affecting ABS, steering assist, speedometer, and shifting subsystems.

Root Cause

The root cause is missing input length validation on data copied into a stack-allocated buffer inside the EC80 firmware, classified as CWE-121 Stack-Based Buffer Overflow. Because the ECU is a safety-critical node with authority on the CAN bus, memory corruption inside the controller translates directly to physical-layer effects on the vehicle.

Attack Vector

Exploitation requires adjacent-network access to the vehicle communications bus or a reachable interface that forwards traffic to the EC80. No authentication or user interaction is required. An attacker with access to the vehicle's diagnostic port, a compromised telematics unit, or a wireless gateway that bridges to the CAN network can deliver the malformed payload. See the CISA ICS Advisory ICSA-26-237-05 and the GitHub CSAF Document for advisory-level technical details.

No public proof-of-concept or exploit code is available at time of publication.

Detection Methods for CVE-2026-67560

Indicators of Compromise

Unexpected ECU resets, diagnostic trouble codes, or loss of ABS, speedometer, or shift function during operation.
Anomalous or malformed CAN frames originating from the EC80 arbitration IDs.
Unexplained bursts of traffic on the vehicle diagnostic bus or telematics gateway logs.

Detection Strategies

Deploy a CAN bus intrusion detection system (IDS) that baselines frame timing, arbitration IDs, and payload structure for the EC80.
Monitor telematics and gateway devices for outbound sessions delivering oversized or malformed vehicle-network payloads.
Correlate fleet diagnostic events showing simultaneous ABS or shift faults across multiple vehicles, which may indicate a coordinated attack.

Monitoring Recommendations

Centralize telematics gateway and fleet management logs in a security data lake for retention and correlation.
Alert on physical access events at diagnostic ports (OBD-II) recorded by fleet telematics.
Track firmware versions of Bendix EC80 units across the fleet and flag unpatched controllers.

How to Mitigate CVE-2026-67560

Immediate Actions Required

Restrict physical and logical access to the vehicle diagnostic bus and any gateway that forwards traffic to the EC80.
Inventory affected Bendix EC80 controllers across the fleet and prioritize safety-critical vehicles for remediation.
Coordinate with Bendix and the vehicle OEM to obtain and schedule the vendor-supplied firmware update.

Patch Information

Refer to the CISA ICS Advisory ICSA-26-237-05 for vendor remediation guidance. Fleet operators should apply the Bendix-approved firmware update through authorized service channels once available and validate the fix against the CSAF advisory referenced in the GitHub CSAF Document.

Workarounds

Disable or physically secure OBD-II and diagnostic ports when vehicles are unattended.
Segment telematics units and infotainment systems from the powertrain and chassis CAN networks using gateway filtering.
Disable unused wireless interfaces (Wi-Fi, Bluetooth, cellular diagnostic services) on telematics units where feasible.
Apply CAN message filtering rules on gateways to drop malformed frames destined for the EC80.

bash

# Example: restrict forwarding on a CAN gateway to expected EC80 arbitration IDs
# Replace 0x0C0 / 0x0C1 with the arbitration IDs authorized for your fleet
cangw -A -s vcan0 -d vcan1 -e -f 0C0:7FF -l
cangw -A -s vcan0 -d vcan1 -e -f 0C1:7FF -l
# Default-deny all other IDs bridged toward the powertrain bus
cangw -A -s vcan0 -d vcan1 -e -f 000:000 -l -X