Loading vulnerability…
Stack-based buffer overflow in OVMS3 PCAP parser
CVE-2026-42468 is a stack-based buffer overflow in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005. The flaw is in canformat_pcap.cpp, where the PCAP/pcapng log parser does not properly validate the attacker-controlled phdr.len field before copying data with memcpy into a fixed-size stack buffer. A crafted PCAP input can therefore cause memory corruption during log parsing. The available reporting states that this issue is one of several OVMS3 parser bugs in which header-derived length fields are copied into fixed-size stack buffers without an upper-bound check.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the affected OVMS3 process, resulting in denial of service. Because the overflow corrupts stack memory, the vulnerability may also permit arbitrary code execution. The CVE metadata further indicates potential high impact to confidentiality, integrity, and availability if exploitation succeeds.
If you can’t patch tonight, do this now.
Do not process untrusted or externally supplied PCAP/pcapng files with vulnerable OVMS3 3.3.005 systems. Restrict who can upload, import, or otherwise provide CAN log files to OVMS3 components. Where possible, isolate log parsing from privileged contexts, apply file-type and size validation before parsing, and use compiler/runtime hardening such as stack canaries, ASLR, and fortified libc builds to reduce exploit reliability. These measures do not remove the flaw but can reduce exposure until a patch is applied.
Patch, then assume compromise.
Upgrade from OVMS3 3.3.005 to a fixed release once available from the vendor or project maintainer. The vulnerable parser logic in canformat_pcap.cpp should be corrected to strictly validate phdr.len against the destination buffer size before any memcpy or equivalent copy operation, and to reject malformed or oversized PCAP/pcapng records. If source-level remediation is required, add explicit upper-bound checks on all header-derived lengths and fail closed on invalid capture records.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.