CVE-2026-37537: Integer Underflow in Open-SAE-J1939 Leads to Out-of-Bounds Write

The National Vulnerability Database has identified CVE-2026-37537, a critical vulnerability in the collin80/Open-SAE-J1939 library. This flaw stems from an integer underflow during Transport Protocol Data Transfer handling. Specifically, when the sequence number from a CAN frame is zero, the calculated index underflows to 255. This leads to an out-of-bounds write, allowing an attacker to write data beyond the intended buffer limits by up to 6 bytes. The National Vulnerability Database assigns this a CVSS score of 8.1 (HIGH).

This vulnerability poses a significant risk to systems utilizing the affected versions of Open-SAE-J1939, particularly in automotive and industrial control environments where the J1939 protocol is common. An attacker with network access could exploit this flaw to overwrite critical memory regions, potentially leading to denial-of-service conditions or even remote code execution. Given the protocol’s use in safety-critical systems, the impact of a successful exploit could be severe.

Defenders should prioritize identifying and patching or updating all instances of collin80/Open-SAE-J1939 to a commit after March 8, 2023, specifically post-744024d4306bc387857dfce439558336806acb06. Network segmentation and strict access controls for systems communicating via J1939 can also mitigate the attack surface. Continuous monitoring for anomalous J1939 traffic patterns is advised.