High severity · published May 1, 2026
CVE-2026-37530
AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) but copies up to 7 bytes (MAX_UDS_REQUEST_PAYLOAD_LENGTH=7) via memcpy at an offset of 1+pid_length (2-3 bytes), resulting in 1-4 bytes of controlled stack overflow. The payload_length field (uint8_t) has no bounds check against the destination buffer. On 32-bit ARM automotive ECUs without stack canaries, this can lead to return address overwrite and RCE.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Automotive Grade Linux · Linuxfoundation
through 17.1.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-37530
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-37530
Broken Link
https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-level
Third Party Advisory
https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643
More from Automotive Grade Linux
9.8
CVE-2026-37531
AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow
7.8
CVE-2026-37525
AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command
7.8
CVE-2026-37526
AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist)…
7.1
CVE-2026-37532
AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library