CVE-2026-56790: CANBoat NMEA-2000 Buffer Overflow Denial of Service

Technical summary

The searchForPgn() function in analyzer/pgn.c performs an off-by-one global buffer overflow when processing NMEA-2000 Parameter Group Numbers (PGNs). A remote attacker can craft a message containing an out-of-range PGN value and deliver it over the CAN bus directly or via N2K-over-IP tunneling protocols. This causes an out-of-bounds array access, triggering a denial of service. The vulnerability is classified as CWE-193 (Off-by-one Error) and permits information disclosure in addition to availability impact, depending on memory layout and attacker control over the crafted message.

Business impact

Marine vessels and marine-adjacent systems relying on CANBoat for real-time navigation and engine data processing face availability risk. A crash in the parser disrupts telemetry ingestion and can cascade to dependent systems that expect continuous data feeds. For commercial shipping, fishing, and offshore operations, even brief outages in data visibility can affect safety monitoring and operational decision-making. Recreational vessels and marine IoT platforms using this parser are similarly exposed.

Affected systems

CANBoat versions up to and including 6.22 are vulnerable. The parser is embedded in marine navigation systems, marine data loggers, N2K diagnostic tools, and open-source marine software stacks. Any system that processes NMEA-2000 data using an affected CANBoat library or binary is in scope. Systems using N2K-over-IP gateways are particularly exposed because attackers need not be physically near the vessel's CAN bus.

Exploitability

Exploitability is moderate to high. An attacker must have network access to the CAN bus (on-vessel or via N2K-over-IP) and must craft a NMEA-2000 message with an invalid PGN—a low-complexity task. No authentication or special privileges are required. However, the attacker's impact is limited to denial of service; there is no code execution pathway. User interaction (such as user actions triggering a message parse) may be required on some deployments, which slightly lowers practical exploitability.

Remediation

Upgrade CANBoat to a version that includes the fix from commit a5a22b7 or later. Verify with the project maintainers or release notes which public version incorporates this patch. Until patching is possible, restrict network access to CAN-bus interfaces and disable N2K-over-IP forwarding on untrusted networks. Implement input validation at gateway/ingestion points to filter out PGN values outside the valid NMEA-2000 range before they reach the parser.

Patch guidance

Consult the CANBoat project repository for tagged releases that incorporate commit a5a22b7. The fix directly addresses the boundary condition in searchForPgn(). Patches should be validated in a testing environment that simulates marine data traffic before production deployment. If the vulnerable version is embedded in a marine device (e.g., a navigation system or logger), contact the device manufacturer for a firmware update that includes the patched CANBoat library.

Detection guidance

Monitor for repeated crashes or service restarts of CANBoat-dependent applications, particularly following receipt of unusual NMEA-2000 traffic. Enable logging of PGN values and message parsing errors. Network-level detection is challenging without access to CAN bus traffic capture, but N2K-over-IP gateways should log message headers including PGN fields. Look for entries showing PGN values far outside the standard NMEA-2000 range (0–262143). Correlation of application crashes with anomalous PGN log entries strongly suggests exploitation attempts.

Why prioritize this

Although the CVSS score is 7.3 (HIGH), this vulnerability merits urgent attention for marine and maritime organizations because availability disruptions in navigation and engine-monitoring systems carry safety implications. The ease of exploitation (low complexity, no authentication) against a specialized but widely-used parser means threat actors targeting maritime victims could weaponize this quickly. Organizations operating vessels or marine IoT systems should prioritize patching within 30 days.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a local or adjacent-network attack vector (AV:L), low attack complexity (AC:L), no privilege requirement (PR:N), potential for user interaction (UI:R), limited scope (S:U), and impact across confidentiality (L), integrity (H), and availability (H). The score appropriately captures the denial-of-service severity and partial information disclosure risk, though in marine deployments the availability impact may carry heightened operational and safety consequences beyond typical IT infrastructure.

Frequently asked questions