Loading vulnerability…
Integer underflow arbitrary memory write in Open-SAE-J1939 SAE_J1939_Read_Transport_Protocol_Data_Transfer
CVE-2026-37534 is an integer underflow vulnerability in Open-SAE-J1939 affecting versions through commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30). The flaw is in SAE_J1939_Read_Transport_Protocol_Data_Transfer, where J1939 transport-protocol message parsing mishandles a size-minus-overhead calculation when processing malformed CAN frames. A crafted sequence number in a CAN frame can cause the subtraction to wrap, and the resulting wrapped value is then used in subsequent memory operations, leading to an out-of-bounds/arbitrary memory write.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt arbitrary memory in the target process handling J1939 traffic. Given the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the expected impact includes potential denial of service via crash, integrity compromise through memory corruption, and possible confidentiality impact if the memory corruption can be leveraged for further code-reuse or control-flow hijacking. The provided sources specifically confirm arbitrary memory write capability.
If you can’t patch tonight, do this now.
Until a fix is deployed, restrict exposure of systems that ingest J1939/CAN traffic from untrusted sources, including bridged, tunneled, or externally reachable CAN interfaces. Filter or reject malformed transport-protocol frames and invalid sequence numbers before they reach the vulnerable parser. Where feasible, isolate CAN/J1939 processing components, enable memory-safety hardening and compiler protections, and monitor for malformed TP Data Transfer frames that could indicate exploitation attempts.
Patch, then assume compromise.
Upgrade to a fixed version of Open-SAE-J1939 that corrects the arithmetic and bounds checking in SAE_J1939_Read_Transport_Protocol_Data_Transfer. Specifically, the vulnerable size/overhead subtraction and any sequence-number-derived offset calculations should be validated before use, with explicit checks preventing underflow and ensuring all computed lengths and offsets remain within the destination buffer. If no patched release is currently available, apply the upstream fix once published and rebuild all affected deployments from corrected source.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.