PT-2026-36505 · Uds-C+1 · Uds-C+1

Feng Ning · Published 2026-05-01 · Updated 2026-05-07 · CVE-2026-37530

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions agl-service-can-low-level versions prior to 17.1.12

Description A stack buffer overflow exists in the uds-c library. The send diagnostic request() function in uds.c allocates a 6-byte stack buffer but copies up to 7 bytes via memcpy at an offset of 1+pid length, allowing 1-4 bytes of controlled stack overflow. This occurs because the payload length variable lacks a bounds check against the destination buffer. On 32-bit ARM automotive ECUs without stack canaries (security mechanisms that detect stack buffer overflows), this can lead to return address overwrite and remote code execution (RCE).

Recommendations Update to version 17.1.12 or later.

Fix

RCE

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-37530

Affected Products

Agl-Service-Can-Low-Level

Uds-C

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-37530 · Security Note
• https://t.me/cveNotify/162560 · Telegram Post
• https://twitter.com/CVEnew/status/2050254037585477634 · Twitter Post
• https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-level · Note
• https://twitter.com/VulmonFeeds/status/2050346009465602282 · Twitter Post
• https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 · Note