Vulnerability-Lookup

CVE-2026-54413 (GCVE-0-2026-54413)

Vulnerability from cvelistv5 – Published: 2026-06-14 17:38 – Updated: 2026-08-10 11:44

Title

iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()

Summary

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.

Severity

7.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-15 15:08 UTC

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)
CWE-125 - Out-of-bounds Read

Assigner

TuranSec

References

4 references

URL	Tags
https://github.com/driftregion/iso14229	product
https://github.com/driftregion/iso14229/blob/main…	product
https://cwe.mitre.org/data/definitions/191.html	technical-description
https://cwe.mitre.org/data/definitions/125.html	technical-description

Impacted products

1 product

Vendor	Product	Version
driftregion	iso14229	Affected: 0 , ≤ 0.9.0 (semver)

Date Public

2026-06-14 17:38

Credits

Burxonov Muslimbek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54413",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T15:08:54.075425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T15:09:01.438Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/driftregion/iso14229",
          "defaultStatus": "unknown",
          "product": "iso14229",
          "programFiles": [
            "iso14229.c"
          ],
          "programRoutines": [
            {
              "name": "Handle_0x27_SecurityAccess"
            }
          ],
          "repo": "https://github.com/driftregion/iso14229",
          "vendor": "driftregion",
          "versions": [
            {
              "lessThanOrEqual": "0.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Burxonov Muslimbek"
        }
      ],
      "datePublic": "2026-06-14T17:38:16.326Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003edriftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.\u003c/p\u003e"
            }
          ],
          "value": "driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A remote unauthenticated attacker who can send a single SecurityAccess (SID 0x27) UDS request to a server built on iso14229 - over CAN bus, OBD-II, ISO-TP, or DoIP - crashes the diagnostic server process and may incidentally read up to roughly 64 KB of memory past the receive buffer through the callback the underflowed length is handed to. In automotive and industrial deployments this denies UDS diagnostics for the affected ECU or controller and, on bare-metal targets without memory protection, the resulting hard fault can take the whole control loop down for the duration of the watchdog reset cycle. No prior authentication, no SecurityAccess unlock, and no user interaction are required - the SecurityAccess handler is reachable in the default session."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "A remote attacker on the same diagnostic transport (CAN/OBD-II/ISO-TP/DoIP) sends one well-formed SecurityAccess request followed by a single-byte 0x27 frame; the second frame triggers the integer underflow in Handle_0x27_SecurityAccess and the application\u0027s SecAccessValidateKey or SecAccessRequestSeed callback then reads up to 65535 bytes past the 4-KB receive buffer, crashing the UDS server process or the bare-metal ECU."
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T11:44:00.458Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "name": "driftregion/iso14229 - upstream repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/driftregion/iso14229"
        },
        {
          "name": "Vulnerable Handle_0x27_SecurityAccess() in iso14229.c",
          "tags": [
            "product"
          ],
          "url": "https://github.com/driftregion/iso14229/blob/main/iso14229.c#L1447"
        },
        {
          "name": "CWE-191: Integer Underflow (Wrap or Wraparound)",
          "tags": [
            "technical-description"
          ],
          "url": "https://cwe.mitre.org/data/definitions/191.html"
        },
        {
          "name": "CWE-125: Out-of-bounds Read",
          "tags": [
            "technical-description"
          ],
          "url": "https://cwe.mitre.org/data/definitions/125.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()",
      "x_assigner_notes": "The missing recv_len lower-bound check was verified by direct source inspection of iso14229.c at the v0.9.0 release tag area and at main HEAD: Handle_0x27_SecurityAccess() begins at line 1447 with \u0027uint8_t subFunction = r-\u003erecv_buf[1];\u0027 and reaches the underflowing \u0027len = (uint16_t)(r-\u003erecv_len - UDS_0X27_REQ_BASE_LEN)\u0027 at lines 1473 and 1511 without any guard on recv_len. Every other sub-function handler in the same file (Handle_0x10 at L911, Handle_0x11 at L960, Handle_0x14 at L996, Handle_0x19 at L1038 with per-sub-function checks, Handle_0x23 at L1418, Handle_0x28 at L1534, and others) performs an explicit \u0027if (r-\u003erecv_len \u003c UDS_0X\u003cXX\u003e_REQ_*_LEN) return NegativeResponse(...)\u0027 check before indexing recv_buf - 0x27 is the sole missing one. The recommended fix is the one-liner: \u0027if (r-\u003erecv_len \u003c UDS_0X27_REQ_BASE_LEN) return NegativeResponse(r, UDS_NRC_IncorrectMessageLengthOrInvalidFormat);\u0027 at the top of the handler, matching the project\u0027s existing pattern. The vulnerability was disclosed to the upstream maintainer through a private GitHub security advisory on 2026-05-26. CVSS scoring matches the precedent set by CVE-2026-54412 (MQTT-C OOB read / integer underflow): VC:L for the bounded heap-byte disclosure, VA:H for the crash on resource-constrained embedded targets, AV:N because the same library is deployed behind DoIP-over-Ethernet diagnostic gateways. Downstream consumers using iso14229 strictly over physical CAN-only deployments may locally lower attackVector to ADJACENT when scoring their own environment.",
      "x_author": "Burxonov Muslimbek"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-54413",
    "datePublished": "2026-06-14T17:38:16.326Z",
    "dateReserved": "2026-06-13T16:39:46.122Z",
    "dateUpdated": "2026-08-10T11:44:00.458Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54413",
      "date": "2026-08-14",
      "epss": "0.00407",
      "percentile": "0.33813"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54413\",\"sourceIdentifier\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"published\":\"2026-06-14T18:17:20.943\",\"lastModified\":\"2026-08-10T12:17:17.403\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.\"},{\"lang\":\"es\",\"value\":\"driftregion iso14229 hasta la versi\u00f3n 0.9.0 contiene un desbordamiento negativo de enteros y una lectura fuera de l\u00edmites posterior en la funci\u00f3n Handle_0x27_SecurityAccess() en iso14229.c que permite a un atacante remoto no autenticado bloquear un servidor UDS y potencialmente leer memoria m\u00e1s all\u00e1 del b\u00fafer de recepci\u00f3n enviando una solicitud SecurityAccess de un solo byte 0x27 que sigue a cualquier mensaje 0x27 bien formado anterior. El gestor lee la subfunci\u00f3n SecurityAccess de recv_buf[1] sin verificar primero que recv_len sea al menos 2, luego calcula la longitud de los datos de la clave como la resta sin signo (uint16_t)(recv_len - UDS_0X27_REQ_BASE_LEN); cuando recv_len es igual a 1, el resultado sufre un desbordamiento negativo a 65535 y se pasa como args.len a la devoluci\u00f3n de llamada SecAccessValidateKey o SecAccessRequestSeed de la aplicaci\u00f3n, que t\u00edpicamente itera o copia esa cantidad de bytes del b\u00fafer de recepci\u00f3n de 4 KB. Cada otro gestor de subfunci\u00f3n UDS en la biblioteca (0x10, 0x11, 0x14, 0x19, 0x22, 0x23, 0x28 y otros) realiza una verificaci\u00f3n expl\u00edcita del l\u00edmite inferior de recv_len antes de la indexaci\u00f3n; Handle_0x27_SecurityAccess es la \u00fanica excepci\u00f3n. El gestor vulnerable es accesible a trav\u00e9s de los transportes CAN bus, OBD-II, ISO-TP y DoIP y est\u00e1 expuesto en la sesi\u00f3n de diagn\u00f3stico predeterminada sin autenticaci\u00f3n previa; las implementaciones en ECUs automotrices, controladores industriales y dispositivos IoT que incluyen iso14229 como su servidor UDS se ven afectadas.\"}],\"affected\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"affectedData\":[{\"vendor\":\"driftregion\",\"product\":\"iso14229\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://github.com/driftregion/iso14229\",\"programFiles\":[\"iso14229.c\"],\"programRoutines\":[{\"name\":\"Handle_0x27_SecurityAccess\"}],\"repo\":\"https://github.com/driftregion/iso14229\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"0.9.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:X\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"DIFFUSE\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-15T15:08:54.075425Z\",\"id\":\"CVE-2026-54413\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"},{\"lang\":\"en\",\"value\":\"CWE-191\"}]}],\"references\":[{\"url\":\"https://cwe.mitre.org/data/definitions/125.html\",\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\"},{\"url\":\"https://cwe.mitre.org/data/definitions/191.html\",\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\"},{\"url\":\"https://github.com/driftregion/iso14229\",\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\"},{\"url\":\"https://github.com/driftregion/iso14229/blob/main/iso14229.c#L1447\",\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54413\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-15T15:08:54.075425Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-15T15:08:57.854Z\"}}], \"cna\": {\"title\": \"iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Burxonov Muslimbek\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"A remote unauthenticated attacker who can send a single SecurityAccess (SID 0x27) UDS request to a server built on iso14229 - over CAN bus, OBD-II, ISO-TP, or DoIP - crashes the diagnostic server process and may incidentally read up to roughly 64 KB of memory past the receive buffer through the callback the underflowed length is handed to. In automotive and industrial deployments this denies UDS diagnostics for the affected ECU or controller and, on bare-metal targets without memory protection, the resulting hard fault can take the whole control loop down for the duration of the watchdog reset cycle. No prior authentication, no SecurityAccess unlock, and no user interaction are required - the SecurityAccess handler is reachable in the default session.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.8, \"Automatable\": \"YES\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"DIFFUSE\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D\", \"exploitMaturity\": \"PROOF_OF_CONCEPT\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"A remote attacker on the same diagnostic transport (CAN/OBD-II/ISO-TP/DoIP) sends one well-formed SecurityAccess request followed by a single-byte 0x27 frame; the second frame triggers the integer underflow in Handle_0x27_SecurityAccess and the application\u0027s SecAccessValidateKey or SecAccessRequestSeed callback then reads up to 65535 bytes past the 4-KB receive buffer, crashing the UDS server process or the bare-metal ECU.\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/driftregion/iso14229\", \"vendor\": \"driftregion\", \"product\": \"iso14229\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"0.9.0\"}], \"programFiles\": [\"iso14229.c\"], \"collectionURL\": \"https://github.com/driftregion/iso14229\", \"defaultStatus\": \"unknown\", \"programRoutines\": [{\"name\": \"Handle_0x27_SecurityAccess\"}]}], \"x_author\": \"Burxonov Muslimbek\", \"datePublic\": \"2026-06-14T17:38:16.326Z\", \"references\": [{\"url\": \"https://github.com/driftregion/iso14229\", \"name\": \"driftregion/iso14229 - upstream repository\", \"tags\": [\"product\"]}, {\"url\": \"https://github.com/driftregion/iso14229/blob/main/iso14229.c#L1447\", \"name\": \"Vulnerable Handle_0x27_SecurityAccess() in iso14229.c\", \"tags\": [\"product\"]}, {\"url\": \"https://cwe.mitre.org/data/definitions/191.html\", \"name\": \"CWE-191: Integer Underflow (Wrap or Wraparound)\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://cwe.mitre.org/data/definitions/125.html\", \"name\": \"CWE-125: Out-of-bounds Read\", \"tags\": [\"technical-description\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003edriftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-191\", \"description\": \"CWE-191 Integer Underflow (Wrap or Wraparound)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"shortName\": \"TuranSec\", \"dateUpdated\": \"2026-08-10T11:44:00.458Z\"}, \"x_assigner_notes\": \"The missing recv_len lower-bound check was verified by direct source inspection of iso14229.c at the v0.9.0 release tag area and at main HEAD: Handle_0x27_SecurityAccess() begins at line 1447 with \u0027uint8_t subFunction = r-\u003erecv_buf[1];\u0027 and reaches the underflowing \u0027len = (uint16_t)(r-\u003erecv_len - UDS_0X27_REQ_BASE_LEN)\u0027 at lines 1473 and 1511 without any guard on recv_len. Every other sub-function handler in the same file (Handle_0x10 at L911, Handle_0x11 at L960, Handle_0x14 at L996, Handle_0x19 at L1038 with per-sub-function checks, Handle_0x23 at L1418, Handle_0x28 at L1534, and others) performs an explicit \u0027if (r-\u003erecv_len \u003c UDS_0X\u003cXX\u003e_REQ_*_LEN) return NegativeResponse(...)\u0027 check before indexing recv_buf - 0x27 is the sole missing one. The recommended fix is the one-liner: \u0027if (r-\u003erecv_len \u003c UDS_0X27_REQ_BASE_LEN) return NegativeResponse(r, UDS_NRC_IncorrectMessageLengthOrInvalidFormat);\u0027 at the top of the handler, matching the project\u0027s existing pattern. The vulnerability was disclosed to the upstream maintainer through a private GitHub security advisory on 2026-05-26. CVSS scoring matches the precedent set by CVE-2026-54412 (MQTT-C OOB read / integer underflow): VC:L for the bounded heap-byte disclosure, VA:H for the crash on resource-constrained embedded targets, AV:N because the same library is deployed behind DoIP-over-Ethernet diagnostic gateways. Downstream consumers using iso14229 strictly over physical CAN-only deployments may locally lower attackVector to ADJACENT when scoring their own environment.\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54413\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T11:44:00.458Z\", \"dateReserved\": \"2026-06-13T16:39:46.122Z\", \"assignerOrgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"datePublished\": \"2026-06-14T17:38:16.326Z\", \"assignerShortName\": \"TuranSec\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54413

Vulnerability from fkie_nvd - Published: 2026-06-14 18:17 - Updated: 2026-06-17 10:58

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Summary

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess() function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. The handler reads the SecurityAccess subFunction from recv_buf[1] without first checking that recv_len is at least 2, then computes the key-data length as the unsigned subtraction (uint16_t)(recv_len - UDS_0X27_REQ_BASE_LEN); when recv_len equals 1 the result underflows to 65535 and is passed as args.len to the application's SecAccessValidateKey or SecAccessRequestSeed callback, which typically iterates or copies that many bytes from the 4-KB receive buffer. Every other UDS sub-function handler in the library (0x10, 0x11, 0x14, 0x19, 0x22, 0x23, 0x28, and others) performs an explicit recv_len lower-bound check before indexing; Handle_0x27_SecurityAccess is the sole outlier. The vulnerable handler reaches over CAN bus, OBD-II, ISO-TP, and DoIP transports and is exposed in the default diagnostic session without prior authentication; deployments on automotive ECUs, industrial controllers, and IoT devices that ship iso14229 as their UDS server are affected.

References

	URL	Tags
	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	https://cwe.mitre.org/data/definitions/125.html
	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	https://cwe.mitre.org/data/definitions/191.html
	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	https://github.com/driftregion/iso14229
	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	https://github.com/driftregion/iso14229/blob/main/iso14229.c#L1447

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/driftregion/iso14229",
          "defaultStatus": "unknown",
          "product": "iso14229",
          "programFiles": [
            "iso14229.c"
          ],
          "programRoutines": [
            {
              "name": "Handle_0x27_SecurityAccess"
            }
          ],
          "repo": "https://github.com/driftregion/iso14229",
          "vendor": "driftregion",
          "versions": [
            {
              "lessThanOrEqual": "0.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess() function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. The handler reads the SecurityAccess subFunction from recv_buf[1] without first checking that recv_len is at least 2, then computes the key-data length as the unsigned subtraction (uint16_t)(recv_len - UDS_0X27_REQ_BASE_LEN); when recv_len equals 1 the result underflows to 65535 and is passed as args.len to the application\u0027s SecAccessValidateKey or SecAccessRequestSeed callback, which typically iterates or copies that many bytes from the 4-KB receive buffer. Every other UDS sub-function handler in the library (0x10, 0x11, 0x14, 0x19, 0x22, 0x23, 0x28, and others) performs an explicit recv_len lower-bound check before indexing; Handle_0x27_SecurityAccess is the sole outlier. The vulnerable handler reaches over CAN bus, OBD-II, ISO-TP, and DoIP transports and is exposed in the default diagnostic session without prior authentication; deployments on automotive ECUs, industrial controllers, and IoT devices that ship iso14229 as their UDS server are affected."
    }
  ],
  "id": "CVE-2026-54413",
  "lastModified": "2026-06-17T10:58:13.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "YES",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "DIFFUSE",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54413",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-15T15:08:54.075425Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-14T18:17:20.943",
  "references": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://cwe.mitre.org/data/definitions/125.html"
    },
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://cwe.mitre.org/data/definitions/191.html"
    },
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://github.com/driftregion/iso14229"
    },
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://github.com/driftregion/iso14229/blob/main/iso14229.c#L1447"
    }
  ],
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        },
        {
          "lang": "en",
          "value": "CWE-191"
        }
      ],
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary"
    }
  ]
}

GHSA-36R7-C6F4-GJ9G

Vulnerability from github – Published: 2026-06-14 18:32 – Updated: 2026-06-14 18:32

Details

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

7.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-54413"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-14T18:17:20Z",
    "severity": "HIGH"
  },
  "details": "driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess() function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. The handler reads the SecurityAccess subFunction from recv_buf[1] without first checking that recv_len is at least 2, then computes the key-data length as the unsigned subtraction (uint16_t)(recv_len - UDS_0X27_REQ_BASE_LEN); when recv_len equals 1 the result underflows to 65535 and is passed as args.len to the application\u0027s SecAccessValidateKey or SecAccessRequestSeed callback, which typically iterates or copies that many bytes from the 4-KB receive buffer. Every other UDS sub-function handler in the library (0x10, 0x11, 0x14, 0x19, 0x22, 0x23, 0x28, and others) performs an explicit recv_len lower-bound check before indexing; Handle_0x27_SecurityAccess is the sole outlier. The vulnerable handler reaches over CAN bus, OBD-II, ISO-TP, and DoIP transports and is exposed in the default diagnostic session without prior authentication; deployments on automotive ECUs, industrial controllers, and IoT devices that ship iso14229 as their UDS server are affected.",
  "id": "GHSA-36r7-c6f4-gj9g",
  "modified": "2026-06-14T18:32:36Z",
  "published": "2026-06-14T18:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54413"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/125.html"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/191.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/driftregion/iso14229"
    },
    {
      "type": "WEB",
      "url": "https://github.com/driftregion/iso14229/blob/main/iso14229.c#L1447"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54413 (GCVE-0-2026-54413)

FKIE_CVE-2026-54413

GHSA-36R7-C6F4-GJ9G

Tags

Sightings

Nomenclature