CVE-2026-37532
Memory Safety in Linuxfoundation Automotive Grade Linux ≤ 17.1.12
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:HSummary
CVE-2026-37532 is a high-severity Buffer Over-read (CWE-126) vulnerability in Linuxfoundation Automotive Grade Linux. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-37532 is a heap buffer over-read vulnerability (CWE-126) affecting AGL agl-service-can-low-level versions through 17.1.12. The flaw resides in the isotp-c library, specifically in the isotp_continue_receive function (receive.c:87-89). Here, the payload_length for a Single Frame is derived from a 4-bit nibble in the CAN frame data, permitting values from 0 to 15. A standard CAN frame, however, offers only 8 bytes total, with payload starting at data[1] and thus 7 bytes available. When payload_length exceeds this—such as a nibble value of 15—the subsequent memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), indicating exploitation requires adjacent network access with low complexity, no privileges, and no user interaction. An attacker on the adjacent network, such as via physical proximity to the CAN bus, can trigger the over-read by sending a crafted CAN frame. This results in low confidentiality impact but high availability impact, likely enabling denial-of-service through application crashes or instability.
Advisories and potential patches are documented in the Automotive Grade Linux Gerrit repository for agl-service-can-low-level (https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-level) and a related GitHub Gist (https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643), which provide source code details and analysis of the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26686
Vulnerability Data
AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN…
more
frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, bounds checking tests) directly finds buffer over-read flaws.
Engineering principles such as memory-safe design and bounds-checked abstractions structurally stop introduction of out-of-bounds reads.
Process isolation limits the blast radius of an over-read to the compromised domain.
Input validation enforces length and index constraints that prevent many externally triggered over-reads.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly prevent introduction of buffer over-read weaknesses.
Vulnerability identification processes can discover buffer over-read flaws via scanning or review.
Patching or replacing vulnerable software removes known instances of buffer over-read bugs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect buffer over-reads before release.
Secure SDLC mandates input validation and bounds checking that can prevent buffer over-reads.
Application security requirements can specify buffer-size and bounds-checking rules.
Secure architecture principles include memory-safety and bounds-checking design choices.
Secure coding standards directly require bounds-checked buffer access, mitigating over-reads.