CVE-2026-73523 COVESA CVE debrief

Who should care

Defenders responsible for CAN bus systems, particularly those using COVESA Open1722, should assess exposure and potential impact due to the high CVSS score and possibility of stack memory disclosure.

Why it matters

CVE-2026-73523 is a high-severity integer truncation vulnerability in COVESA Open1722 that allows unauthenticated remote attackers to cause CAN listener to transmit process stack memory onto the CAN bus, potentially leading to stack memory disclosure.

• Verify exposure of CAN listener to potential attackers.
• Assess potential impact of stack memory disclosure on CAN bus.
• Implement compensating controls to limit potential damage.
• Monitor CAN bus activity for suspicious frames.

Technical summary

The vulnerability is caused by an integer truncation issue in acf-can-listener.c, which allows a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus. This issue arises from the num_can_msgs variable, declared as uint8_t, truncating the -1 error return value from avtp_to_can() to 255. This could potentially lead to stack memory disclosure on the CAN bus. Defenders should prioritize verifying exposure and assessing potential impact due to the high CVSS score of 8.7 and the possibility of stack memory disclosure.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact due to the high CVSS score of 8.7 and the possibility of stack memory disclosure.

Recommended defensive actions

• Verify exposure by checking if the CAN listener is enabled and if the system is vulnerable to this issue.
• Assess potential impact by evaluating the sensitivity of the data stored on the CAN bus and the potential consequences of stack memory disclosure.
• Implement compensating controls, such as network segmentation or access controls, to limit the potential damage.
• Monitor CAN bus activity for suspicious frames and implement incident response plans in case of a potential exploit.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by an integer truncation issue in acf-can-listener.c, which allows a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.