CVE-2026-37539: Critical Buffer Overflow in Cannelloni CAN FD Parsing
The National Vulnerability Database (NVD) has published details on CVE-2026-37539, a critical buffer overflow vulnerability affecting cannelloni v2.0.0. Specifically, the flaw resides in the parseCANFrame function within parser.cpp and the decodeFrame function in decoder.cpp, both responsible for handling CAN FD frames. This vulnerability carries a CVSS score of 9.8, signaling its severe impact.
Remote attackers can exploit this weakness by sending specially crafted CAN FD frames. The immediate consequence is a denial of service, causing the affected system to crash. However, the NVD warns of the potential for arbitrary code execution, which would grant attackers full control over the compromised device. Given the ubiquitous nature of CAN bus systems in industrial control, automotive, and other embedded environments, this vulnerability poses a significant risk to operational technology (OT) and critical infrastructure.
Defenders must prioritize identifying any instances of cannelloni v2.0.0 in their environments. While affected products are not explicitly listed by NVD, any system leveraging this specific version of cannelloni for CAN frame parsing is at risk. Organizations should prepare for immediate patching or mitigation strategies once a fix is released.
What This Means For You
- If your operational technology (OT) or embedded systems utilize cannelloni v2.0.0 for CAN frame parsing, you are exposed to a critical remote code execution risk. This isn't just a crash; it's a gateway for attackers to take control of critical hardware. Identify all instances of this software immediately and prepare to patch or isolate these systems the moment a fix is available.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-37539: Critical Buffer Overflow in Cannelloni CAN FD Parsing - Initial Access
title: CVE-2026-37539: Critical Buffer Overflow in Cannelloni CAN FD Parsing - Initial Access
id: scw-2026-05-01-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-37539 by sending crafted CAN FD frames to a web endpoint that processes them. This rule specifically looks for POST requests to a '/cannelloni/parse' URI with 'CAN FD frame' in the query string, indicative of an attempt to trigger the buffer overflow in the cannelloni v2.0.0 parser.
author: SCW Feed Engine (AI-generated)
date: 2026-05-01
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-37539/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- 'CAN FD frame'
cs-uri|contains:
- '/cannelloni/parse'
cs-method|exact:
- 'POST'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-37539 | Buffer Overflow | cannelloni v2.0.0 |
| CVE-2026-37539 | DoS | cannelloni v2.0.0 in parser.cpp in function parseCANFrame |
| CVE-2026-37539 | RCE | cannelloni v2.0.0 in decoder.cpp in function decodeFrame |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 01, 2026 at 20:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7588 — Ggerve Coding-Standards-Mcp Path Traversal
CVE-2026-7588 — A vulnerability was found in ggerve coding-standards-mcp. This issue affects the function get_style_guide/get_best_practices of the file server.py. The manipulation of the argument Language...
CVE-2026-35233 — Denial of Service
CVE-2026-35233 — An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to...
CVE-2026-7587 — Open5GS Denial of Service
CVE-2026-7587 — A vulnerability has been found in Open5GS up to 2.7.7. This vulnerability affects the function amf_nsmf_pdusession_handle_update_sm_context of the file /src/amf/nsmf-handler.c of the component...