The driftregion iso14229 library up to version 0.9.0 contains an integer underflow and subsequent out-of-bounds read in the Handle_0x27_SecurityAccess() function within iso14229.c. The function reads the SecurityAccess subFunction from recv_buf[1] without verifying that the received message length (recv_len) is at least 2. When recv_len equals 1, the subtraction (recv_len - UDS_0X27_REQ_BASE_LEN) underflows as an unsigned 16-bit integer, resulting in a large length value (65535). This length is passed to security access callbacks that then iterate or copy data beyond the 4 KB receive buffer, causing memory corruption. This vulnerability is unique to the 0x27 SecurityAccess handler, as other UDS sub-function handlers perform proper length checks. The flaw is exposed over multiple transport protocols (CAN bus, OBD-II, ISO-TP, DoIP) and is accessible in the default diagnostic session without authentication, affecting automotive, industrial, and IoT deployments using this UDS server implementation.

A remote unauthenticated attacker can send a specially crafted single-byte 0x27 SecurityAccess request to crash the UDS server, causing denial of service. Additionally, the attacker may read memory beyond the intended receive buffer, potentially exposing sensitive information or enabling further exploitation. The vulnerability affects devices running the vulnerable iso14229 library, including automotive ECUs, industrial controllers, and IoT devices. The CVSS 4.0 base score is 7.8 (high), reflecting network attack vector, no privileges or user interaction required, and high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing input validation to ensure recv_len is at least 2 before processing the 0x27 SecurityAccess request. Restricting access to the UDS server or disabling the 0x27 SecurityAccess handler if not needed may reduce exposure. Monitor vendor channels for updates or patches addressing this vulnerability.