CVE-2026-54413 describes an integer underflow and subsequent out-of-bounds read in the Handle_0x27_SecurityAccess function of the iso14229 component in driftregion versions up to 0.9.0. The vulnerability arises when a remote unauthenticated attacker sends a single-byte 0x27 SecurityAccess request immediately after a well-formed 0x27 message, causing the integer underflow and enabling a crash of the UDS server and potential memory disclosure beyond the intended buffer boundaries.

The vulnerability allows remote unauthenticated attackers to cause a denial of service by crashing the UDS server. Additionally, it may lead to unauthorized memory disclosure by reading data past the receive buffer, which could expose sensitive information. There is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the vendor's communications for updates and avoid exposing vulnerable iso14229 services to untrusted networks until a fix is available.