Loading vulnerability…
Stack Buffer Overflow in miaofng/uds-c send_diagnostic_request
CVE-2026-37536 is a stack-based buffer overflow in the miaofng/uds-c project, associated with commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a. The flaw is in send_diagnostic_request in uds.c, where service data from a request structure is copied with memcpy into a fixed-size stack buffer used to build a UDS diagnostic request. The destination buffer is 6 bytes long (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6), but the copy occurs at offset 1+pid_length and uses attacker-controlled payload_length without validating that the total write fits in the buffer. With pid_length reaching 2 and MAX_UDS_REQUEST_PAYLOAD_LENGTH defined as 7, the code path can write 10 bytes total into a 6-byte stack buffer, overflowing it by 4 bytes. The root cause is missing bounds checking on payload_length before memcpy.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt adjacent stack memory during construction of a UDS request. Depending on compiler, platform, and calling context, this can cause process crashes, denial of service, corruption of program state, or potentially control-flow hijacking and arbitrary code execution. The associated CVSS vector indicates high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Until a code fix is deployed, do not allow untrusted or externally influenced diagnostic request structures to reach send_diagnostic_request. Constrain payload_length to safe values before invoking the library, disable or isolate functionality that builds UDS requests from untrusted inputs, and apply compiler/runtime hardening such as stack canaries and ASLR where feasible. Additional defensive validation at higher layers should enforce strict limits on UDS service payload sizes and PID lengths.
Patch, then assume compromise.
Update the affected code so that send_diagnostic_request validates payload_length and the combined write size before calling memcpy. The implementation should ensure that 1 + pid_length + payload_length never exceeds MAX_DIAGNOSTIC_PAYLOAD_SIZE, reject or truncate oversized requests, and use size-safe request-building logic. If a fixed-size stack buffer is retained, all offsets and lengths should be derived with explicit upper-bound checks. If available, migrate to a patched revision of the library that corrects the bounds checking in uds.c.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.