Skip to content
Integer Overflow Vulnerability in UDS Server Allows Remote Memory Access

Integer Overflow Vulnerability in UDS Server Allows Remote Memory Access

First seen 16 Oct 2026, 05:50 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 16, 2026 at 07:37 UTC
  • •An integer overflow in the UDS server allows remote attackers to read beyond buffer limits.
  • •Attackers can exploit this vulnerability without authentication using a crafted packet.
  • •The vulnerability is linked to CVE-2026-54413, with a patch already available.

An integer overflow vulnerability in the Handle_0x38_RequestFileTransfer function of iso14229.c allows unauthenticated remote attackers to bypass a length bounds check. By sending a specially crafted UDS RequestFileTransfer packet, attackers can cause the application-level callback to read approximately 61 KB of heap memory beyond the 4,095-byte receive buffer. This issue affects systems using the ISO 14229 protocol over various transport methods, including CAN bus and OBD-II. The vulnerability is linked to CVE-2026-54413, which was published on June 14, 2026. The flaw can lead to denial of service and potential disclosure of sensitive memory contents. A patch has been released to address this vulnerability, but the current exploitation status remains unclear.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-14
CVE-2026-54413 published
A related vulnerability was disclosed, highlighting integer wraparound issues in the UDS server.
Article 1
2026-10-16
Vulnerability disclosed
The integer overflow vulnerability was detailed, allowing attackers to exploit memory access issues.
Article 2

More articles in this cluster (2)

Following this threat?

Track CVE-2026-54413 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 3

Common questions

What systems are affected?
The vulnerability affects systems using the ISO 14229 protocol over various transport methods, including CAN bus and OBD-II.
Is there a patch available?
Yes, a patch has been released to address the integer overflow vulnerability.
What are the potential impacts of this vulnerability?
The vulnerability can lead to denial of service and potential disclosure of sensitive memory contents.