CVE-2026-37534 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: May 1, 2026
Open-SAE-J1939 - Integer Underflow
Published: May 1, 2026Updated: May 1, 2026Remote Exploitable
Overview
Open-SAE-J1939 contains an integer underflow caused by improper handling of sequence numbers in SAE_J1939_Read_Transport_Protocol_Data_Transfer, letting attackers write to arbitrary memory via crafted CAN frame sequence number.
Severity & Score
Severity: Critical
CVSS Score: 9.8
Impact
Attackers can write to arbitrary memory, potentially leading to code execution or system compromise.
Mitigation
Update to the latest version including commit b6caf884df46435e539b1ecbf92b6c29b345bdfe or later.
References
Related Resources
Details
- CVE ID
- CVE-2026-37534
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- integer_overflow
- Status
- new
CWE
- CWE-191
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H