Two Buffer Overflows in OVMS3 Expose Vehicle Monitoring Systems to DoS and RCE
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen May 1, 2026
Two high-severity vulnerabilities have been disclosed in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005, both stemming from improper input validation that can lead to buffer overflows. CVE-2026-42469 affects canformat_canswitch.cpp, where the software fails to properly validate a CANswitch DLC value; a remote attacker can send crafted CANswitch frames to trigger a denial of service and potentially achieve arbitrary code execution. The flaw is tracked as CWE-121 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating network-reachable exploitation with no privileges or user interaction required and a high impact on availability.
A second flaw, CVE-2026-42468, affects canformat_pcap.cpp, where OVMS3 does not correctly validate the phdr.len field while parsing PCAP input. An attacker can use crafted PCAP data to cause a denial of service and potentially execute arbitrary code; the updated CVSS v3.1 scoring indicates user interaction is required and that confidentiality, integrity, and availability may all be affected. The CVE records were updated to refine severity details, add CWE-121 classification, and, for CVE-2026-42469, include a public GitHub Gist reference.
