Multiple Memory Corruption Flaws Disclosed in Automotive CAN Libraries

Innora Security Research disclosed 11 vulnerabilities across eight automotive CAN-related libraries and tools, including Open-SAE-J1939, isotp-c, uds-c, socketcand, cannelloni, OpenAMP, and OVMS3. The issues span integer underflow and overflow, stack and heap buffer overflows, and other out-of-bounds memory access conditions affecting software used in ECUs, CAN gateways, diagnostic tooling, industrial networks, and research platforms. The report said several flaws are reachable through crafted CAN frames, tunneled CAN traffic, malformed firmware images, or malicious log files, with many assigned CVSS 9.8 severity due to the potential for remote memory corruption and service disruption.

One of the newly tracked issues, CVE-2026-37537, affects collin80/Open-SAE-J1939 through commit 744024d4306bc387857dfce439558336806acb06. In the library's Transport Protocol Data Transfer handling, a CAN frame with data[0] = 0 causes the calculation uint8_t index = data[0] - 1 to underflow to 255, leading to an out-of-bounds write past the allocated MAX_TP_DT buffer. The vulnerability was assigned CVSS v3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, indicating an adjacent-network attack path with high integrity and availability impact, and it underscores broader unsafe length handling and unchecked memory operations across the affected CAN software ecosystem.