CVE-2026-67560: CWE-121 in Bendix EC80ESP+ J1708

CVE-2026-67560 describes a stack-based buffer overflow vulnerability (CWE-121) in the Bendix EC80ESP+ J1708 Brake ECU. This vulnerability allows an attacker to crash the ECU and potentially execute arbitrary code remotely or inject arbitrary CAN bus traffic. The impact includes loss of key vehicle control functions including ABS, steering assist, speedometer, and shifting. The CVSS v3.1 base score is 7.5, indicating high severity, with attack vector as adjacent network, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to denial of critical vehicle functions such as ABS, steering assist, speedometer, and shifting by crashing the ECU or injecting malicious CAN bus traffic. This compromises vehicle safety and control, affecting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published. Until a patch is available, monitor vendor communications for updates and consider risk mitigation strategies appropriate for embedded vehicle systems.