An open-source tool that moves audio, video and CAN traffic across automotive Ethernet can be forced to spill its own stack memory onto the car’s CAN bus with a single network packet. Researcher Fatullayev Asadbek disclosed the flaws through VulnCheck this week, and both sit in the ACF CAN listener of COVESA Open1722, reachable by unauthenticated remote attackers.
Attackers trigger CVE-2026-73522 with a UDP datagram that packs more than 15 ACF-CAN messages. avtp_to_can() advances a write index against a fixed 15-slot stack array without ever bounding it, so each extra message lands beyond the buffer’s end. Stream IDs ride in plaintext and no authentication is required, meaning any device on the network segment can fire the datagram. The result is corruption of adjacent stack memory, a path to arbitrary code execution or a denial-of-service crash.
The second flaw, CVE-2026-73523, is an integer truncation rated CVSS 8.7. The num_can_msgs variable is declared as uint8_t, which turns the -1 error return from avtp_to_can() into 255. The write loop then runs 255 times against the 15-slot array, leaking roughly 18KB of adjacent stack memory as about 240 CAN frames that any recipient on the bus can read.
Open1722 is the Connected Vehicle Systems Alliance’s open-source implementation of the IEEE 1722 (AVTP) standard, used to stream audio and video and tunnel CAN and LIN messages in vehicle development and test rigs. Both bugs affect versions through 0.9.2, the current release, and no patched build was available at disclosure time. The report was filed as GitHub issue 154, with a second advisory covering the overflow variant. For teams running Open1722 in gateways or validation benches, the memory disclosure puts a component’s internal state on the CAN bus for any other ECU to read.
