CVE-2026-37537 describes an integer underflow in the Open-SAE-J1939 project up to commit 744024d4306bc387857dfce439558336806acb06. The issue occurs in the Transport Protocol Data Transfer code where a uint8_t index is calculated as data[0] - 1. If data[0] is zero, the index underflows to 255, causing subsequent writes to exceed the MAX_TP_DT buffer size by 6 bytes, resulting in an out-of-bounds write. This vulnerability can lead to memory corruption and potentially arbitrary code execution or denial of service depending on exploitation context. The CVSS 3.1 score is 8.1, reflecting high impact on availability and integrity with low attack complexity and no privileges required.

The vulnerability allows an attacker to cause an out-of-bounds write by sending a CAN frame with a sequence number of zero, leading to memory corruption. This can impact the integrity and availability of the affected system. There is no indication of confidentiality impact. No known exploits are reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor the Open-SAE-J1939 project for updates. Until a fix is released, consider applying input validation or filtering on CAN frames to prevent sequence number zero if feasible in the deployment environment.