CVE-2026-54413: Integer Underflow in iso14229 UDS Library Allows Memory Read and DoS

Technical summary

CVE-2026-54413 is an integer underflow vulnerability in the Handle_0x27_SecurityAccess() function within iso14229.c. The flaw occurs because the handler reads the SecurityAccess subFunction from recv_buf[1] without verifying that recv_len is at least 2 bytes. When recv_len equals 1, the subsequent unsigned subtraction (uint16_t)(recv_len - UDS_0X27_REQ_BASE_LEN) underflows to 65535 (0xFFFF). This enormous value is then passed as args.len to the application's SecAccessValidateKey or SecAccessRequestSeed callback, which typically iterates or copies that many bytes from a 4-KB receive buffer, resulting in a massive out-of-bounds read. Every other UDS sub-function handler in the library (0x10, 0x11, 0x14, 0x19, 0x22, 0x23, 0x28, etc.) includes explicit recv_len bounds checks before indexing; this handler is a singular outlier, indicating a gap in defensive programming practices across the codebase.

Business impact

Organizations deploying iso14229 as their UDS server face dual risks: immediate denial-of-service (DoS) against diagnostic infrastructure and potential exposure of sensitive data stored or processed on affected systems. In automotive contexts, this can disrupt manufacturer diagnostics, warranty servicing, and fleet management. For industrial and IoT deployments, diagnostic unavailability may trigger operational alerts or trigger fallback modes. The low barrier to exploitation (a single-byte malformed message) and lack of authentication requirements mean that threat actors on the same network segment—or any attacker with network access to CAN, OBD-II, ISO-TP, or DoIP transports—can trigger the flaw without prior reconnaissance or credentials.

Affected systems

Any device or application shipping driftregion iso14229 library version 0.9.0 or earlier that exposes UDS diagnostic services is affected. This includes automotive ECUs (Engine Control Units), body control modules, transmission controllers, battery management systems in electric vehicles, industrial programmable logic controllers, and IoT devices that implement UDS over CAN, OBD-II, ISO-TP, or DoIP transports. The vulnerability is reachable in the default diagnostic session without authentication, making it accessible to any attacker with network or physical access to these buses.

Exploitability

Exploitation is trivial: an attacker need only send a single, minimally formatted 0x27 SecurityAccess UDS request (one byte) over any of the four supported transports. No special tooling, authentication, or prior knowledge of the target is required. The crash is immediate and deterministic. Memory disclosure requires the application's callback to iterate or copy from the buffer, making the severity dependent on the callback implementation, but the possibility of reading up to 4 KB of adjacent memory (depending on buffer placement and callback logic) is realistic. The vulnerability has not yet been observed in active exploit or added to CISA's Known Exploited Vulnerabilities (KEV) catalog, but the low complexity and broad applicability suggest rapid exploitation is likely once public disclosure occurs.

Remediation

Apply an immediate update to driftregion iso14229 to a version newer than 0.9.0 once it becomes available. If patched versions are not yet released, implement network segmentation to restrict access to UDS diagnostic interfaces (CAN, OBD-II, ISO-TP, DoIP) to authorized diagnostic tools and subnets only. As a temporary mitigation, disable or restrict the UDS diagnostic session in production environments if not actively required, or enforce physical access controls on buses where diagnostic traffic travels. Audit callbacks registered with SecAccessValidateKey and SecAccessRequestSeed to understand how they handle unexpectedly large length values and consider adding application-layer bounds checks.

Patch guidance

Monitor the driftregion iso14229 project repository and release notes for version 0.9.1 or later, which should include a recv_len >= 2 check in Handle_0x27_SecurityAccess() consistent with other UDS handlers. Verify the patched code includes explicit validation before any buffer access. Once a patch is released, prioritize deployment to all automotive and industrial systems running 0.9.0 or earlier. Test patches in a non-production environment first, particularly if diagnostic tools depend on UDS; ensure the bounds check does not inadvertently block legitimate diagnostic messages. For vendors shipping iso14229 in their products, coordinate with driftregion on backport availability if you are not on the latest upstream version.

Detection guidance

Monitor CAN, OBD-II, ISO-TP, and DoIP traffic for unusual or malformed 0x27 UDS SecurityAccess requests, particularly single-byte messages. Network intrusion detection systems can identify anomalous UDS diagnostic sessions initiated from unexpected sources. On the device level, enable logging of UDS handler errors and crashes; a sudden spike in Handle_0x27 failures or unhandled exceptions is a strong indicator. If available, enable verbose logging in the iso14229 library or wrap the vulnerable function with instrumentation to log recv_len values at the time of crash. Cross-correlate UDS diagnostic sessions with known maintenance windows and authorized tool source addresses.

Why prioritize this

This vulnerability merits immediate attention despite being unpatched. The CVSS 3.1 score of 8.2 (HIGH) reflects both high impact (memory disclosure, DoS) and high exploitability (no authentication, low complexity). Automotive and industrial environments are critical infrastructure; denial of diagnostic services can have cascading operational consequences. The absence of a single bounds check against the pattern used across the rest of the library strongly suggests the flaw is both real and easily patchable, meaning fixes will likely ship within weeks. Early patching and network isolation will minimize exposure during the window before patches reach all affected deployments.

Risk score, explained

The 8.2 HIGH CVSS score (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) reflects: (1) Network-accessible attack vector (AV:N), (2) Low attack complexity (AC:L)—no special setup required, (3) No privileges or user interaction (PR:N, UI:N), (4) Limited scope (S:U)—impact confined to the UDS server itself, (5) Low confidentiality impact (C:L)—memory disclosure is possible but constrained, and (6) High availability impact (A:H)—reliable DoS. The score appropriately penalizes the ease of exploitation and the criticality of diagnostic infrastructure in automotive and industrial systems; it does not rise to CRITICAL only because the impact is primarily availability and limited information disclosure rather than remote code execution or full system compromise.

Frequently asked questions