Loading vulnerability…
CVE-2026-37537 affects collin80/Open-SAE-J1939 through commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08). The flaw is in Transport Protocol Data Transfer handling, where the code computes uint8_t index = data[0] - 1. Because data[0] is the sequence number from a CAN frame, an attacker can supply a frame with sequence number 0, causing the subtraction to underflow and index to become 255. The resulting index is then used in a write to tp_dt->data[255*7 + i-1], which can reach offset 1791. This exceeds the MAX_TP_DT buffer size of 1785 bytes by 6 bytes, producing an out-of-bounds write. The root cause is improper handling of arithmetic on an unsigned value derived from attacker-controlled input, resulting in memory corruption during J1939 TP.DT reassembly/processing.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
data[0] == 0, enforce valid J1939 TP.DT sequence-number ranges before buffer access, and ensure computed offsets cannot exceed MAX_TP_DT. If no fixed upstream release is available, patch the affected code to perform bounds checking on both the sequence number and the final write offset before writing into tp_dt->data.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.