An integer overflow in the Handle_0x38_RequestFileTransfer() function of iso14229.c allows a remote unauthenticated attacker to bypass a length bounds check and pass a fabricated 16-bit length value (65,532) to the application-level callback, causing the callback to read approximately 61 KB of heap memory past the end of the 4,095-byte receive buffer. The issue is triggered by a single 5-byte UDS RequestFileTransfer packet over any supported transport (CAN bus, OBD-II, ISO-TP, DoIP) without prior authentication or session negotiation. Impact includes denial of service (server process crash) and potential disclosure of heap memory contents to the attacker.
Root cause — iso14229.c line 2023–2033:
When an attacker sends file_path_len = 0xFFFC (65,532) the addition 4 + 65532 = 65536 is computed as a 32-bit int and then truncated to uint16_t, yielding 0. The guard condition (0 > recv_len) is always false, so the bounds check is silently bypassed.
After the bypass, the library populates UDSRequestFileTransferArgs_t with: args.filePathLen = 65532 (attacker-controlled) args.filePath = &recv_buf[4] (pointer into the 4095-byte recv_buf)
and calls EmitEvent(srv, UDS_EVT_RequestFileTransfer, &args) (iso14229.c:2093).
Any application callback that consumes args.filePathLen bytes from args.filePath — for example to copy the path before fopen(), compute a checksum, or write a diagnostic log — will read ≈61 KB (65532 − 4091) past the end of recv_buf, which is embedded in the heap-allocated UDSServer_t struct.
The vulnerability is structurally similar to CVE-2026-54413 (which affects Handle_0x27_SecurityAccess in the same library) but involves a different handler, a different integer-arithmetic class (addition wrap vs. subtraction underflow), and a different CWE root cause.
Dispatch path — no authentication gate: iso14229.c:2374 routes SID 0x38 as a "Service_without_sub-function", calling Handle_0x38_RequestFileTransfer directly without requiring a prior SecurityAccess (0x27) unlock. The vulnerability is therefore reachable in the default diagnostic session with no credentials.
iso14229 HEAD (commit b0e92b1 , version 0.9.0)
Linux x86-64, gcc ≥ 12, AddressSanitizer
Reproduced 3/3 on Linux x86-64 (gcc 13, Ubuntu 24.04).
Any process embedding iso14229 as a UDS server and registering a UDS_EVT_RequestFileTransfer callback is affected. The handler is reachable over CAN bus, OBD-II, ISO-TP, and DoIP without prior authentication.
Denial of Service — the out-of-bounds read typically causes a segmentation fault or watchdog reset, crashing the diagnostic server. On automotive ECUs this can disable OTA updates, remote diagnostics, and safety-relevant diagnostic monitors for the duration of the reset cycle.
Denial of Service — the out-of-bounds read typically causes a segmentation fault or watchdog reset, crashing the diagnostic server. On automotive ECUs this can disable OTA updates, remote diagnostics, and safety-relevant diagnostic monitors for the duration of the reset cycle.
Heap Memory Disclosure — an attacker whose transport provides a response channel (e.g., DoIP over Ethernet) may be able to observe heap contents leaked through the callback's side effects (logs, error responses containing path data, or covert channels in timing). Approximately 61 KB of heap data past recv_buf may be exposed in a single request.
Heap Memory Disclosure — an attacker whose transport provides a response channel (e.g., DoIP over Ethernet) may be able to observe heap contents leaked through the callback's side effects (logs, error responses containing path data, or covert channels in timing). Approximately 61 KB of heap data past recv_buf may be exposed in a single request.
Affected deployments include automotive ECUs, industrial controllers, and IoT devices that use iso14229 ≤ 0.9.0 as their UDS server implementation.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
