CVE-2026-42485
Published: 01 May 2026
Summary
CVE-2026-42485 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Automotivelinux (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-42485 is a stack buffer overflow vulnerability in the AGL agl-service-can-low-level component, specifically within the uds-c library's send_diagnostic_request function in uds.c. The function allocates a 6-byte stack buffer defined by MAX_DIAGNOSTIC_PAYLOAD_SIZE=6, but uses memcpy to copy up to 7 bytes from MAX_UDS_REQUEST_PAYLOAD_LENGTH=7 at an offset of 1+pid_length (2-3 bytes), resulting in 1-4 bytes of controlled stack overflow. This occurs due to no bounds check on the uint8_t payload_length field against the destination buffer. The issue affects 32-bit ARM automotive ECUs lacking stack canaries, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and CWE-121 (Stack-based Buffer Overflow).
Remote attackers can exploit this vulnerability over the network without privileges or user interaction by sending a crafted diagnostic request that triggers the overflow. On vulnerable 32-bit ARM automotive ECUs without stack canaries, this enables overwriting the return address, potentially leading to remote code execution (RCE).
Mitigation details are referenced in the Automotive Grade Linux Gerrit repository at https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-level and a related Gist at https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26698
Vulnerability details
AGL agl-service-can-low-level contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) but copies up to 7 bytes (MAX_UDS_REQUEST_PAYLOAD_LENGTH=7) via memcpy at an offset of 1+pid_length (2-3 bytes), resulting in…
more
1-4 bytes of controlled stack overflow. The payload_length field (uint8_t) has no bounds check against the destination buffer. On 32-bit ARM automotive ECUs without stack canaries, this can lead to return address overwrite and RCE.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network exploitation of stack buffer overflow for RCE without auth/UI directly enables T1190 (Exploit Public-Facing Application) for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack buffer overflow by correcting the buffer size mismatch and adding bounds checks on payload_length in the uds-c library's send_diagnostic_request function.
Requires validation of the uint8_t payload_length field against the 6-byte destination buffer before memcpy to prevent the controlled stack overflow.
Implements stack canaries or equivalent memory protections to detect buffer overflow and prevent return address overwrite leading to RCE on 32-bit ARM ECUs.