PT-2026-36508 · Undefined · Undefined

Feng Ning · Published 2026-05-01 · Updated 2026-05-12 · CVE-2026-37534

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open-SAE-J1939 versions prior to commit b6caf884df46435e539b1ecbf92b6c29b345bdfe

Description An integer underflow exists in the SAE J1939 Read Transport Protocol Data Transfer() function. This allows attackers to write to arbitrary memory by using a crafted sequence number from the CAN frame.

Recommendations Update to a version containing commit b6caf884df46435e539b1ecbf92b6c29b345bdfe.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-37534

Affected Products

Undefined

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-37534 · Security Note
• https://github.com/DanielMartensson/Open-SAE-J1939 · Note
• https://reddit.com/r/pwnhub/comments/1t1uav5/critical_security_flaw_found_in_opensaej1939 · Reddit Post
• https://twitter.com/lyrie_ai/status/2054120973738086783 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054120974551765137 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054120976284066300 · Twitter Post
• https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 · Note