CVE-2026-111282

8.2High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-190

Impact

Unauthenticated remote attackers can crash the target service or leak memory contents. They only need network access to send a crafted RequestFileTransfer (SID 0x38) UDS packet.

Root cause

An integer wraparound when validating filePathAndNameLength values between 0xFFFC and 0xFFFF bypasses length checks and triggers an out-of-bounds read past the receive buffer.

Affected systems

Driftregion iso14229 versions prior to 0.10.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Fix & remediation

Upgrade Driftregion iso14229 to version 0.10.1 or later. If updating immediately is not possible, disable or block incoming UDS RequestFileTransfer (SID 0x38) messages at the network or firewall boundary.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111282