{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nebula-1.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-74238"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nebula (1.2.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","iot","robotics"],"_cs_type":"advisory","_cs_vendors":["TIER IV"],"content_html":"\u003cp\u003eTIER IV Nebula versions up to and including 1.2.0 contain an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function. This vulnerability allows an unauthenticated remote attacker to trigger a read past the end of a UDP buffer by sending a maliciously crafted, short UDP datagram to the Velodyne sensor port. Because the service lacks sender-address restrictions, the decoder processes adjacent heap memory as part of the packet. These memory contents are then transformed into fabricated points and published into downstream PointCloud2 messages utilized by Autoware nodes. This exploitation can lead to the corruption of sensor perception data in autonomous vehicle systems, potentially impacting safety-critical decision-making processes.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the injection of garbage data into the perception pipeline of autonomous systems running the Nebula driver. This can lead to incorrect environment mapping or object detection errors. The vulnerability is specific to the Nebula middleware component used within the Autoware ecosystem, primarily impacting deployments that interface with Velodyne-compatible lidar sensors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the Nebula driver component to a version containing the patch for CVE-2026-74238. For organizations unable to immediately update, implement network-level access control lists (ACLs) on the gateway or vehicle network interface to restrict UDP traffic to the Velodyne sensor port to only known, authorized IP addresses.\u003c/p\u003e\n","date_modified":"2026-08-17T20:50:39Z","date_published":"2026-08-17T20:50:39Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nebula-oob-read/","summary":"TIER IV Nebula through 1.2.0 is vulnerable to an out-of-bounds read in the Vlp32Decoder::unpack function, allowing remote attackers to inject fabricated point cloud data via malformed UDP packets.","title":"Out-of-Bounds Read in TIER IV Nebula","url":"https://feed.craftedsignal.io/briefs/2026-08-nebula-oob-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Nebula (1.2.0)","version":"https://jsonfeed.org/version/1.1"}