Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck

CVE-2026-73522COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener

High 7.5

In plain English

A high-severity stack buffer overflow in Open1722 from COVESA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 90% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)4.0%top 9.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory to achieve arbitrary code execution or denial of service.

Affected products (as reported)

Vendor	Product	Versions
COVESA	Open1722	0 – through 0.9.2

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Researcher Disclosure issue-tracking
https://www.vulncheck.com/advisories/covesa-open1722-stack-buffer-overflow-via-avtp-to-can-in-acf-can-listener third-party-advisory