CVE-2026-37537
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedcollin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8_t index = data[0] - 1. When data[0] (sequence number from CAN frame) is 0, index underflows to 255. Subsequent write at tp_dt->data[255*7 + i-1] reaches offset 1791, exceeding the MAX_TP_DT buffer (1785 bytes) by 6 bytes.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceInteger underflow in Transport Protocol Data Transfer handling where `uint8_t index = data[0] - 1` underflows when data[0] (sequence number from CAN frame) is 0, resulting in index=255. This causes an out-of-bounds write at offset 1791, exceeding the MAX_TP_DT buffer of 1785 bytes by 6 bytes.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Adjacent
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify CAN Transport Protocol usageSearch for ISO-TP (ISO 15765-2) or CAN TP implementation in the codebase. Look for references to TP_DT, transport protocol, isotp, or can_tp in source files and configuration.Affected if The system implements or uses CAN Transport Protocol for transmitting CAN frames larger than 8 bytes.
-
Locate TP DT handling codeFind the function handling TP Data Transfer frames. Search for the pattern where data[0] is read and used as a sequence number, typically in a function named handle_tp_dt, process_tp_dt, or similar.Affected if TP Data Transfer handling code exists that reads the sequence number from data[0].
-
Check for the vulnerable subtraction patternSearch for the code pattern 'uint8_t index = data[0] - 1' or equivalent where an unsigned integer is used to subtract 1 from the CAN frame sequence number.Affected if The code uses unsigned integer subtraction (data[0] - 1) without first validating that data[0] is greater than 0.
-
Verify sequence number validationInspect the TP DT handling function to confirm whether there is a bounds check or validation ensuring data[0] > 0 or 1 <= data[0] <= 15 before the subtraction operation.Affected if No validation exists to ensure the sequence number is >= 1 before the subtraction, allowing underflow when data[0] equals 0.
-
Confirm buffer size configurationCheck if MAX_TP_DT or similar buffer is defined as 1785 bytes, and verify the code performs offset calculations that could reach 1791 (index * 1791 + offset).Affected if The implementation uses a buffer size of 1785 bytes for TP DT and performs index-based offset calculations.
If the system processes CAN frames using Transport Protocol and the TP DT handling lacks validation that the sequence number (data[0]) is greater than 0 before performing the unsigned subtraction, the integer underflow can occur and cause a 6-byte buffer overflow.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataAdd validation to ensure the sequence number (data[0]) is greater than 0 before performing the subtraction, or use a signed integer type with appropriate bounds checking to prevent the underflow condition.
- Consultation2.0 h
- Implementation1.0 h
- Testing3.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,936.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-37537 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-37537 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data