CVE WatchAug 17, 2026

CVE-2026-73523

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attacker

CVSS

7.5

High

EPSS

0.3%

p25

KEV

—

Exploit Today

0-100

Published: Aug 17, 2026 · Last modified: Aug 17, 2026 · CWE-197

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-08-182026-08-19

Technical description

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-770145.3 MED

—

——0A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.13h CVE-2026-65610—

—

——0nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is promoted to signed int and becomes -1 and producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.10h CVE-2026-49263—

2.9%

——1Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.3d CVE-2026-688047.8 HIG

28.4%

——9Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.7d CVE-2026-657986.7 MED

16.8%

——5Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.3d CVE-2026-657976.7 MED

16.7%

——5Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.3d