CVE-2026-42468 is a buffer overflow vulnerability in OVMS3 3.3.005, specifically in the canformat_pcap.cpp parser component. The issue stems from improper validation of the phdr.len field, enabling remote attackers to supply malicious PCAP input that can trigger a denial of service or possibly arbitrary code execution. The vulnerability is remotely exploitable without privileges and requires user interaction. OVMS3 is delivered as a cloud service, and the vendor manages remediation server-side. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to denial of service or arbitrary code execution on the OVMS3 cloud service, potentially compromising confidentiality, integrity, and availability of the system. Given the high CVSS score (8.8), the impact is significant. However, there are currently no known exploits in the wild.

Since OVMS3 is a cloud-hosted service, the vendor is responsible for applying patches and managing remediation. Users should verify with the vendor advisory that their service instance has been updated. No additional user action is required unless otherwise directed by the vendor. Patch status is confirmed as available, so ensure the service is running the patched version.