Vulnerability · Published Jun 14, 2026 · Assigned by TuranSec

CVE-2026-54413iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()

High 8.2

In plain English

A high-severity out-of-bounds read in iso14229 from driftregion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 64.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.

Affected products (as reported)

Vendor	Product	Versions
driftregion	iso14229	0 – through 0.9.0

Weakness: CWE-191, CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

References

driftregion/iso14229 - upstream repository product
Vulnerable Handle_0x27_SecurityAccess() in iso14229.c product
CWE-191: Integer Underflow (Wrap or Wraparound) technical-description
CWE-125: Out-of-bounds Read technical-description