---
id: CVE-2026-73522
title: >-
  COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability
  that allows unauthenticated remote attackers to write past the end of a fixed
  15-slot stack array by sending a crafted UDP datagram containing more than 15
  ACF-…
summary: >-
  COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability
  that allows unauthenticated remote attackers to write past the end of a fixed
  15-slot stack array by sending a crafted UDP datagram containing more than 15
  ACF-…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-121
published: '2026-08-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73522'
references:
  - url: 'https://github.com/COVESA/Open1722/issues/154'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/covesa-open1722-stack-buffer-overflow-via-avtp-to-can-in-acf-can-listener
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.03954
epssPercentile: 0.90028
ingestedAt: '2026-09-24T20:51:40.205Z'
---

## Overview

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts datagrams from any sender matching a hardcoded unauthenticated stream ID transmitted in plaintext, attackers can corrupt adjacent stack memory to achieve arbitrary code execution or denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.