CVE-2026-74238: TIER IV Nebula Buffer Overflow Vulnerability

CVE-2026-74238 Overview

CVE-2026-74238 is an out-of-bounds read vulnerability in TIER IV Nebula through version 1.2.0, a sensor driver framework used by the Autoware autonomous driving stack. The flaw resides in the Vlp32Decoder::unpack() function, which processes Velodyne VLP-32 LiDAR sensor data received over UDP. Unauthenticated remote attackers can send a short, malformed UDP datagram to the Velodyne sensor port to cause the decoder to read past the end of the received buffer into adjacent heap memory. The Velodyne UDP listener lacks sender-address restrictions applied to other drivers, allowing arbitrary network hosts to reach the parser.

Critical Impact
Fabricated point-cloud points derived from heap memory contents are silently published into downstream PointCloud2 messages consumed by Autoware nodes, corrupting perception data used for autonomous driving decisions.

Affected Products

TIER IV Nebula through 1.2.0
Autoware nodes that consume PointCloud2 messages produced by Nebula
Deployments using the Velodyne VLP-32 UDP decoder

Discovery Timeline

2026-08-17 - CVE-2026-74238 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in the NVD database

Technical Details for CVE-2026-74238

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Vlp32Decoder::unpack() routine. Nebula parses incoming Velodyne UDP datagrams and iterates over expected fixed-size data blocks when constructing point-cloud output. When the received datagram is shorter than the block structure the decoder expects, unpack() continues to dereference offsets past the tail of the received buffer.

Because the buffer is heap-allocated, the decoder reads adjacent heap memory whose contents are attacker-influenced only in position, not value. Nebula does not treat these reads as errors and does not discard the resulting points. The fabricated coordinates are appended to the outgoing PointCloud2 message and published on the Autoware perception topic.

Downstream perception, obstacle-detection, and planning nodes consume these fabricated points as legitimate LiDAR returns, degrading the integrity of the autonomous driving pipeline.

Root Cause

The root cause is missing length validation before structured decoding. Vlp32Decoder::unpack() assumes any datagram delivered to the Velodyne UDP port matches the VLP-32 packet layout. It does not verify that the received byte count contains a full complement of data blocks before indexing into them.

Attack Vector

An attacker sends a single short UDP datagram to the Velodyne sensor port on the host running Nebula. No authentication is required. Unlike other Nebula sensor drivers, the Velodyne UDP path does not restrict traffic to the configured sensor IP address, so any host with network reachability to the port can trigger the parser.

The vulnerability does not disclose memory contents to the attacker over the network. Instead, it corrupts the integrity of the point-cloud output delivered to Autoware, which is the impact reflected in the CVSS vector (VI:H, VC:N, VA:N).

See the VulnCheck advisory and the Nebula GitHub Issue #488 for maintainer discussion and technical detail.

Detection Methods for CVE-2026-74238

Indicators of Compromise

Inbound UDP datagrams to the configured Velodyne sensor port from source addresses that do not match the deployed LiDAR device.
UDP datagrams to the Velodyne port whose length is shorter than a full VLP-32 data packet.
Anomalous or spatially implausible points appearing in published PointCloud2 topics without a corresponding change in the physical environment.

Detection Strategies

Instrument the Nebula driver host with packet capture on the sensor UDP port and alert on datagrams below the expected VLP-32 packet size.
Compare source addresses of incoming Velodyne UDP traffic against the configured sensor IP and flag mismatches.
Monitor Autoware perception node logs for parser warnings or bursty spikes in point-cloud message size that do not correlate with sensor state.

Monitoring Recommendations

Baseline the expected UDP packet size and rate from the LiDAR device and alert on deviations at the network layer.
Forward host and network telemetry from vehicle compute platforms to a centralized analytics backend for correlation across fleet units.
Track releases of the Nebula repository and subscribe to the upstream issue tracker to catch fixed versions and related advisories.

How to Mitigate CVE-2026-74238

Immediate Actions Required

Restrict inbound UDP traffic to the Velodyne sensor port at the host firewall so that only the physical LiDAR device address can reach the driver.
Segment the sensor network from any general-purpose or externally reachable network path on the vehicle compute platform.
Audit deployed Nebula versions across fleet vehicles and identify all hosts running versions through 1.2.0.

Patch Information

At time of publication, no fixed release version is enumerated in the NVD entry. Track the upstream Nebula GitHub Issue #488 and the VulnCheck advisory for the fixed version and upgrade once available. When applying the fix, verify that Vlp32Decoder::unpack() validates datagram length before structured indexing and that the Velodyne UDP listener enforces sender-address restrictions consistent with other Nebula drivers.

Workarounds

Apply host firewall rules that allow UDP to the Velodyne port only from the configured sensor IP.
Place the LiDAR device on a dedicated physical or VLAN-isolated network segment with no external routing.
If VLP-32 support is not required, disable the Velodyne UDP decoder in the Nebula configuration to remove the attack surface.

bash

# Configuration example: restrict Velodyne UDP port to the sensor IP only
# Replace SENSOR_IP with the configured LiDAR device address
# Replace VELODYNE_PORT with the configured Nebula listen port (commonly 2368)
iptables -A INPUT -p udp --dport VELODYNE_PORT -s SENSOR_IP -j ACCEPT
iptables -A INPUT -p udp --dport VELODYNE_PORT -j DROP