PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-37541 openvehicles CVE debrief

CVE-2026-37541 is a critical buffer overflow in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. According to the CVE record, canformat_gvret.cpp does not properly validate the length field in GVRET binary data, so crafted GVRET frames can trigger a denial of service and may permit arbitrary code execution. NVD classifies the issue as remotely exploitable with no privileges or user interaction required, and with high impact to confidentiality, integrity, and availability.

Vendor
openvehicles
Product
Open-Vehicle-Monitoring-System-3
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-01
Original CVE updated
2026-05-20
Advisory published
2026-05-01
Advisory updated
2026-05-20

Who should care

Operators, integrators, and maintainers of OVMS3 3.3.005 deployments should treat this as urgent, especially where GVRET data is accepted over reachable network interfaces. Security teams responsible for embedded, telematics, or vehicle-monitoring systems should also review exposure and patch status.

Technical summary

The NVD record for CVE-2026-37541 maps the flaw to CWE-121 and describes a buffer overflow in canformat_gvret.cpp. The vulnerable code path processes GVRET binary frames without properly validating the length field, allowing a remote attacker to send crafted input that can overflow memory. The published CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates network reachability, low attack complexity, no authentication, no user interaction, and potentially severe impact if the flaw is successfully exploited.

Defensive priority

Immediate

Recommended defensive actions

  • Identify all OVMS3 installations and confirm whether version 3.3.005 is deployed.
  • Treat any network-exposed or remotely reachable GVRET input path as high risk until the vendor guidance or fix is applied.
  • Apply the upstream/vendor remediation referenced in the linked advisory or issue tracker as soon as it is available.
  • If immediate patching is not possible, reduce exposure by limiting access to the interfaces that accept GVRET data.
  • Monitor affected systems for crashes, abnormal restarts, or other signs of malformed-frame handling problems.
  • Validate inventory and configuration so affected firmware is not left untracked in embedded or vehicle-monitoring deployments.

Evidence notes

The supplied corpus includes the CVE record, NVD entry, and NVD API source item. The record states that OVMS3 3.3.005 is vulnerable, that the flaw is in canformat_gvret.cpp, and that the length field in GVRET binary data is not properly validated. NVD marks the record as analyzed and assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H with CWE-121. References in the corpus also include a third-party advisory, the upstream Open-Vehicle-Monitoring-System-3 repository, and an issue-tracking entry.

Official resources

Publicly disclosed in the CVE record on 2026-05-01 and last modified in the supplied source data on 2026-05-20. This debrief uses only the provided corpus and linked official references.