Loading vulnerability…
CVE-2026-37536 is a stack-based buffer overflow in the miaofng/uds-c project, associated with commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a. The flaw is in send_diagnostic_request in uds.c, where service data from a request structure is copied with memcpy into a fixed-size stack buffer used to build a UDS diagnostic request. The destination buffer is 6 bytes long (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6), but the copy occurs at offset 1+pid_length and uses attacker-controlled payload_length without validating that the total write fits in the buffer. With pid_length reaching 2 and MAX_UDS_REQUEST_PAYLOAD_LENGTH defined as 7, the code path can write 10 bytes total into a 6-byte stack buffer, overflowing it by 4 bytes. The root cause is missing bounds checking on payload_length before memcpy.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.