CVE-2026-37541: Ovms3 Gvret Binary Build Can Frame Length Unbounded
Legacy 2-argument canformat::Serve() invocation on the externally reachable canlog TCP server attack surface, or unbounded use of the attacker-controlled `build_can_frame.length` field inside the GVRET binary parser. In the BUILD_CAN_FRAME path, the 1-byte length is used directly as a memcpy/Pop size into the fixed 8-byte CAN_frame_t::data and the ~16-byte s
C++greprules fetch cve-2026-37541-ovms3-gvret-binary-build-can-frame-length-unbounded --engine opengrepDescription
Legacy 2-argument canformat::Serve() invocation on the externally reachable canlog TCP server attack surface, or unbounded use of the attacker-controlled `build_can_frame.length` field inside the GVRET binary parser. In the BUILD_CAN_FRAME path, the 1-byte length is used directly as a memcpy/Pop size into the fixed 8-byte CAN_frame_t::data and the ~16-byte s
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.