CVE-2026-37530 Details
Description
AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) but copies up to 7 bytes (MAX_UDS_REQUEST_PAYLOAD_LENGTH=7) via memcpy at an offset of 1+pid_length (2-3 bytes), resulting in 1-4 bytes of controlled stack overflow. The payload_length field (uint8_t) has no bounds check against the destination buffer. On 32-bit ARM automotive ECUs without stack canaries, this can lead to return address overwrite and RCE.
A stack buffer overflow vulnerability has been identified in the AGL service CAN low-level component, specifically in versions through 17.1.12. The issue arises in the UDS-C library within the 'send_diagnostic_request' function, where a 6-byte stack buffer is allocated but is vulnerable to overflow by up to 1 byte. This occurs because the 'payload_length' field is copied into the buffer without proper bounds checking, allowing for 1-4 bytes of controlled overflow. On 32-bit ARM automotive ECUs lacking stack canaries, this vulnerability could be exploited to overwrite the return address and execute arbitrary code.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-level | [email protected] | Broken Link |
| https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation automotive grade linux | <= 17.1.12 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | New CVE Received | [email protected] |