A numeric truncation vulnerability in COVESA Open1722 versions 0 through 0.9.2 creates a risk of sensitive stack memory disclosure to unauthenticated attackers.

This vulnerability is a numeric truncation error (CWE-197) in the ACF CAN listener. It allows an unauthenticated, remote attacker to trigger conditions that disclose internal stack memory contents.

With a CVSS score of 7.5, this vulnerability represents a significant security risk. Unauthorized disclosure of stack memory can lead to the exposure of cryptographic keys, session tokens, or other sensitive data, potentially facilitating further attacks against the host system.

Immediate Action: Check the official COVESA Open1722 repository for patched releases and update the software to the latest version.

Proactive Monitoring: Review system and application logs for unusual memory access patterns or unauthorized attempts to probe the CAN listener interface.

Compensating Controls: Utilize host-based intrusion detection systems to monitor for anomalous memory access or unexpected crashes within the Open1722 process space.

Public Exploit Available: Unknown

The risk of memory disclosure necessitates prompt action. Users of the COVESA Open1722 software should verify their current version and update to a version that addresses the numeric truncation flaw to maintain data confidentiality.