openxc/isotp-c Out-of-Bounds Read: DoS and Info Leak via Malicious CAN Frame

The National Vulnerability Database (NVD) has detailed CVE-2026-37535, a high-severity out-of-bounds read vulnerability in openxc/isotp-c affecting commits up to 5a5d19245f65189202719321facd49ce6f5d46ac (August 9, 2021). This flaw resides in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is directly used as the memcpy size without proper validation against the actual CAN data length.

Attackers can exploit this by sending a crafted CAN frame with an oversized length nibble. This forces the system to read memory beyond the intended buffer, leading to two critical impacts: denial of service (DoS) due to memory corruption, or the potential leakage of sensitive information from adjacent memory regions. The NVD assigns a CVSS score of 7.1 (High), highlighting the significant risk posed by this vulnerability, particularly given its network access vector.

For defenders, this is a clear warning that even low-level automotive communication protocols are not immune to fundamental memory safety issues. While openxc/isotp-c is a specific open-source library, the underlying vulnerability type — improper input validation leading to out-of-bounds reads — is a perennial problem. Organizations leveraging this library, or any similar custom implementations of ISO-TP, must prioritize patching and rigorous input validation at the CAN frame processing layer. An attacker only needs network access to the CAN bus to trigger this, making it a critical concern for connected vehicle systems and industrial control environments.