iso14229: Out-of-bounds read via integer wraparound in RequestFileTransfer

Summary

The UDS library iso14229 before 0.10.1 contains an integer wraparound in the handler for service 0x38 (RequestFileTransfer). A remote, unauthenticated attacker can send a short request with a manipulated filePathAndNameLength value (0xFFFC to 0xFFFF) that bypasses the file path length check. The callbacks then read past the receive buffer, which can crash the device or disclose memory contents. Exposure depends on whether an affected build is reachable over a network-facing diagnostic transport.

Affected

• driftregion iso14229 versions 0 to before 0.10.1
• Products, firmware or tools that embed an affected iso14229 version (vendors not identified)

Fixed in

• Upgrade to iso14229 0.10.1 or later (release tag 0.10.1+9e7c47e8)

Workaround

• No vendor workaround published.
• Restrict UDS/diagnostic transports (CAN, ISO-TP, DoIP) to trusted networks.
• Disable service 0x38 (RequestFileTransfer) where file transfer is not required. This is a recommendation, not a documented vendor measure.

Exploitation

• CISA SSVC assessment in the CVE record: exploitation status 'poc', automatable 'yes', technical impact 'partial'.
• The CVE record does not state that the vulnerability is listed in CISA KEV. Unknown.

Our recommendation

• Check whether any device, firmware or in-house tool embeds iso14229 before 0.10.1, and ask vendors about their embedded UDS stack.
• Confirm which diagnostic transports are reachable from untrusted networks.
• Upgrade to iso14229 0.10.1 or later, or obtain vendor firmware that includes the fix.
• Monitor vendor advisories and the GitHub security advisory for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GHSA-5hgv-5fqg-8vcr security advisory github.com
• iso14229 release 0.10.1+9e7c47e8 github.com
• Fix commit 2e36afcd github.com
• src/server.c at tag 0.10.0 (vulnerable code) github.com
• VulnCheck advisory www.vulncheck.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:08.