CVE-2026-37538
Published: 01 May 2026
Summary
CVE-2026-37538 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-37538 is a buffer overflow vulnerability (CWE-121) affecting socketcand version 0.4.2, specifically in the file socketcand.c within the main function. The flaw allows attackers to trigger the issue by supplying a crafted bus_name parameter. It received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its potential for significant availability disruption with network-based exploitation requiring low complexity and no privileges or user interaction.
Remote, unauthenticated attackers can exploit this vulnerability over the network by sending a specially crafted bus_name to the affected socketcand instance. Successful exploitation leads to a denial of service, such as application crash or service unavailability, with the possibility of other unspecified impacts due to the buffer overflow nature.
Mitigation details and further technical information are available in the referenced advisories, including a GitHub Gist at https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 and the upstream socketcand repository at https://github.com/dschanoeh/socketcand. The vulnerability was published on 2026-05-01.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26691
Vulnerability details
Buffer overflow vulnerability in socketcand 0.4.2 in file socketcand.c in function main allows attackers to cause a denial of service or other unspecified impacts via crafted bus_name.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable buffer overflow in the network-accessible socketcand service, directly enabling attackers to exploit a public-facing application (T1190) for denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the known buffer overflow flaw in socketcand 0.4.2 by applying patches or upgrades to eliminate the vulnerability.
Mandates validation of the crafted bus_name input to prevent buffer overflows from oversized or malformed network inputs.
Implements memory protections such as stack guards and address space randomization to mitigate exploitation of the buffer overflow in socketcand.