Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) but copies up to 7 bytes (MAX_UDS_REQUEST_PAYLOAD_LENGTH=7) via memcpy at an offset of 1+pid_length (2-3 bytes), resulting in 1-4 bytes of controlled stack overflow. The payload_length field (uint8_t) has no bounds check against the destination buffer. On 32-bit ARM automotive ECUs without stack canaries, this can lead to return address overwrite and RCE.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-37530 Stack Buffer Overflow in AGL agl-service-can-low-level Through 17.1.12 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-37530
Post summary
A stack buffer overflow (CVE‑2026‑37530) is disclosed in AGL agl‑service‑can‑low‑level up to version 17.1.12, with no exploit, PoC, patch, or active exploitation details provided.
CVE-2026-37530 AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte sta… https://www.cve.org/CVERecord?id=CVE-2026-37530
Post summary
The post discloses technical details of CVE-2026-37530, describing a stack buffer overflow in the uds-c library without providing PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linuxfoundation | automotive_grade_linux | - | - | - |