CVE-2026-73523 Overview
CVE-2026-73523 is an integer truncation vulnerability [CWE-197] in COVESA Open1722 through version 0.9.2. The flaw resides in acf-can-listener.c, where the num_can_msgs variable is declared as uint8_t. When avtp_to_can() returns -1 to signal an error, the assignment truncates the value to 255. The resulting write loop iterates 255 times over a 15-slot stack array. Unauthenticated remote attackers can trigger this behavior by sending a crafted UDP datagram with a matching AVTP stream ID, causing the CAN listener to emit approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.
Critical Impact
A single rejected UDP datagram leaks approximately 18 KB of process stack memory onto the CAN bus, exposing potentially sensitive in-vehicle data to any CAN participant.
Affected Products
- COVESA Open1722 versions through 0.9.2
- The acf-can-listener utility built from acf-can-listener.c
- Downstream integrations bundling Open1722 AVTP-to-CAN bridging
Discovery Timeline
- 2026-08-17 - CVE-2026-73523 published to the National Vulnerability Database
- 2026-08-17 - Last updated in NVD database
Technical Details for CVE-2026-73523
Vulnerability Analysis
Open1722 implements the IEEE 1722 Audio Video Transport Protocol (AVTP), including a CAN listener that receives AVTP-encapsulated CAN frames over UDP and forwards them onto a CAN bus. The listener uses avtp_to_can() to decode incoming datagrams into an array of CAN messages, then loops over that array to write frames to the CAN interface.
The conversion function returns a signed integer indicating either the number of decoded messages or -1 on rejection. The listener stores this return value directly in num_can_msgs, a uint8_t. When the decoder returns -1, the value truncates to 255. The subsequent transmit loop treats num_can_msgs as a valid count and iterates 255 times across a stack-allocated array sized for only 15 CAN messages. Each iteration reads a 72-byte adjacent stack region and transmits it as a CAN frame, disclosing roughly 18 KB of process memory.
Root Cause
The root cause is an unsafe implicit narrowing conversion from a signed int error sentinel into an unsigned 8-bit counter. No range check verifies that the return value is non-negative or bounded by the destination array size before the transmit loop runs.
Attack Vector
An unauthenticated remote attacker sends a single UDP datagram to the AVTP listener. The datagram must carry a stream ID matching a configured subscription so that the listener processes it, but it must otherwise be malformed enough for avtp_to_can() to return -1. The resulting 240 CAN frames are broadcast to every device on the CAN bus, disclosing stack contents such as pointers, return addresses, and buffered protocol data.
No verified proof-of-concept code is publicly available. Refer to the VulnCheck Advisory on Memory Disclosure and the GitHub Issue Discussion for further technical detail.
Detection Methods for CVE-2026-73523
Indicators of Compromise
- Bursts of approximately 240 CAN frames emitted immediately after a single inbound AVTP UDP datagram
- CAN frame payloads containing high-entropy or pointer-like values inconsistent with configured signal maps
- AVTP UDP datagrams from unexpected sources carrying valid stream IDs but malformed ACF-CAN payloads
Detection Strategies
- Deploy CAN bus monitoring that flags anomalous frame bursts correlated to individual UDP inputs on the AVTP port.
- Inspect AVTP traffic for datagrams that match configured stream IDs but fail schema validation.
- Add runtime assertions or fuzzing coverage around avtp_to_can() return handling in build pipelines.
Monitoring Recommendations
- Log all rejected AVTP datagrams with source address, stream ID, and reject reason.
- Alert when CAN transmit rates from a listener process exceed the configured maximum per datagram.
- Correlate host process memory metrics with unexpected CAN traffic spikes for forensic review.
How to Mitigate CVE-2026-73523
Immediate Actions Required
- Restrict network reachability to the AVTP UDP listener using firewall rules or segmented VLANs.
- Disable or unbind the acf-can-listener on systems that do not require AVTP-to-CAN bridging.
- Audit configured AVTP stream IDs and remove any that are not actively required.
Patch Information
No fixed release is referenced in the enriched advisory data at the time of publication. Track the GitHub Issue Discussion for upstream remediation status. A correct fix changes num_can_msgs to a signed type, validates that avtp_to_can() returned a non-negative value, and bounds the transmit loop by the destination array size.
Workarounds
- Rebuild Open1722 with a local patch that stores the avtp_to_can() return value in an int and returns early when the value is negative.
- Enforce a strict min(num_can_msgs, ARRAY_SIZE) bound before entering the CAN transmit loop.
- Isolate AVTP endpoints behind authenticated network segments to remove unauthenticated remote reach.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
