CVE-2026-42467
Published: 01 May 2026
Summary
CVE-2026-42467 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-42467 is a denial-of-service vulnerability in the Open-SAE-J1939 library through commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (dated 2025-11-30). The issue resides in the SAE_J1939_Read_Binary_Data_Transfer_DM16 function and is triggered by a crafted CAN frame on the J1939 bus. Classified under CWE-400 (Uncontrolled Resource Consumption), it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting high availability impact with network accessibility and low attack complexity.
An attacker with access to the J1939 bus can exploit this vulnerability without privileges or user interaction. By transmitting a specially crafted CAN frame, they induce a denial-of-service condition, disrupting service availability on affected systems while leaving confidentiality and integrity unaffected.
Mitigation details are available in the referenced advisory at https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26695
Vulnerability details
An issue was discovered in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Binary_Data_Transfer_DM16 causing a denial of service via crafted CAN frame on the J1939 bus.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables direct exploitation of the application via crafted network input (J1939 CAN frame) to trigger uncontrolled resource consumption and denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws in the Open-SAE-J1939 library, directly remediating CVE-2026-42467 to prevent DoS from crafted CAN frames.
Implements denial-of-service protection mechanisms to limit or control resource exhaustion effects from crafted J1939 DM16 frames on the CAN bus.
Mandates validation of information inputs like J1939 binary data transfer frames to block malformed CAN frames causing uncontrolled resource consumption.