CVE-2025-32058

Deeper analysis

CVE-2025-32058 affects the Infotainment ECU manufactured by Bosch, which incorporates a RH850 module for CAN communication. This module connects to the infotainment main SoC over the INC interface via a custom protocol. The vulnerability arises during processing of these protocol requests on the V850 side of the RH850, classified as CWE-121 (stack-based buffer overflow). It was first identified in the Nissan Leaf ZE1 manufactured in 2020 and carries a CVSS v3.1 base score of 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

An attacker requires prior code execution on the infotainment main SoC to exploit the vulnerability. Successful exploitation grants code execution on the RH850 module, allowing the attacker to send arbitrary CAN messages over the connected CAN bus. The local attack vector, low complexity, lack of privileges or user interaction, and scope change to high-impact confidentiality, integrity, and availability effects underscore its severity in an automotive context.

Advisories provide further details, including a PCA Cybersecurity resource on vulnerabilities in Bosch-manufactured Nissan infotainment (https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch) and a Black Hat Asia 2025 presentation on remote exploitation of the Nissan Leaf (http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf). The CVE was published on 2026-02-15.