Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck

CVE-2026-74238TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

High 7.5

In plain English

A high-severity out-of-bounds read in nebula from tier4. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 58.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.

Affected products (as reported)

Vendor	Product	Versions
tier4	nebula	0 – through 1.2.0

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Researcher Disclosure issue-tracking
https://www.vulncheck.com/advisories/tier-iv-nebula-heap-out-of-bounds-read-via-vlp32-udp-decoder third-party-advisory