{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-73522/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-73522"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open1722 (0.9.2)","Open1722"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","buffer-overflow","automotive","cve-2026-73522"],"_cs_type":"advisory","_cs_vendors":["COVESA"],"content_html":"\u003cp\u003eCOVESA Open1722 versions up to 0.9.2 contain a critical stack-based buffer overflow vulnerability in the avtp_to_can() function. The vulnerability is triggered when the software processes a crafted UDP datagram containing more than 15 ACF-CAN messages. The implementation incorrectly increments the write index for a fixed 15-slot stack array without performing bounds checking against the caller-supplied array size.\u003c/p\u003e\n\u003cp\u003eBecause the library listens for datagrams from any sender that matches a hardcoded, unauthenticated stream ID transmitted in plaintext, an attacker on the local network segment can send malicious packets to the listener. Successful exploitation allows for the corruption of adjacent stack memory, leading to a crash (denial of service) or the potential for arbitrary code execution in the context of the process running Open1722. This issue is particularly relevant to automotive networking components utilizing the IEEE 1722 protocol standard.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthenticated remote attackers to crash systems using Open1722 or potentially gain execution privileges on the host. This poses a significant risk to in-vehicle networking and automotive infrastructure where IEEE 1722 implementations are deployed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of the Open1722 library immediately upon availability.\u003c/li\u003e\n\u003cli\u003eImplement network-level segmentation to restrict UDP traffic directed at the Open1722 listener to known, authorized sources only.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for malformed IEEE 1722 (AVTP) datagrams containing an abnormally high count of ACF-CAN messages that exceed standard operational thresholds.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T18:50:36Z","date_published":"2026-08-17T18:50:28Z","id":"https://feed.craftedsignal.io/briefs/2026-08-open1722-overflow/","summary":"COVESA Open1722 versions through 0.9.2 are vulnerable to a stack-based buffer overflow in the avtp_to_can function that allows unauthenticated remote attackers to achieve arbitrary code execution via crafted UDP datagrams.","title":"Stack Buffer Overflow in COVESA Open1722","url":"https://feed.craftedsignal.io/briefs/2026-08-open1722-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-73522","version":"https://jsonfeed.org/version/1.1"}