Loading vulnerability…
Integer Underflow Leading to Out-of-Bounds Write in Open-SAE-J1939 Transport Protocol Data Transfer
CVE-2026-37537 affects collin80/Open-SAE-J1939 through commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08). The flaw is in Transport Protocol Data Transfer handling, where the code computes uint8_t index = data[0] - 1. Because data[0] is the sequence number from a CAN frame, an attacker can supply a frame with sequence number 0, causing the subtraction to underflow and index to become 255. The resulting index is then used in a write to tp_dt->data[255*7 + i-1], which can reach offset 1791. This exceeds the MAX_TP_DT buffer size of 1785 bytes by 6 bytes, producing an out-of-bounds write. The root cause is improper handling of arithmetic on an unsigned value derived from attacker-controlled input, resulting in memory corruption during J1939 TP.DT reassembly/processing.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt memory beyond the end of the TP.DT reassembly buffer, with high integrity and availability impact. Based on the provided CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), the primary consequences are corruption of in-memory protocol state and potential process instability or crash/denial of service. No confidentiality impact is indicated in the provided source material.
If you can’t patch tonight, do this now.
Until a fix is deployed, reduce exposure to untrusted CAN/J1939 traffic. Filter or drop malformed TP.DT frames with invalid sequence numbers, especially sequence number 0, at gateways or bus interfaces. Limit adjacent-network/local bus access to trusted devices, isolate diagnostic and test environments from untrusted CAN sources, and add runtime validation or defensive wrappers around TP.DT frame parsing where feasible. Monitoring for malformed J1939 transport frames may help detect exploitation attempts.
Patch, then assume compromise.
Update Open-SAE-J1939 to a version or commit that validates the TP.DT sequence number before subtracting 1 or using it as an index. Specifically, reject or safely handle data[0] == 0, enforce valid J1939 TP.DT sequence-number ranges before buffer access, and ensure computed offsets cannot exceed MAX_TP_DT. If no fixed upstream release is available, patch the affected code to perform bounds checking on both the sequence number and the final write offset before writing into tp_dt->data.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.