CVE-2026-73523 describes an integer truncation vulnerability in COVESA Open1722 through version 0.9.2, specifically in acf-can-listener.c. When the avtp_to_can() function returns -1 on error, the num_can_msgs variable, declared as an unsigned 8-bit integer, truncates this value to 255. This causes a loop to iterate 255 times over a 15-slot stack array, resulting in the transmission of approximately 18 KB of adjacent stack memory as roughly 240 CAN frames onto the CAN bus. The vulnerability can be triggered remotely without authentication by sending a rejected UDP datagram with a matching AVTP stream ID, leading to unintended memory disclosure on the CAN bus.

An unauthenticated remote attacker can exploit this vulnerability to cause the CAN listener to leak sensitive process stack memory onto the CAN bus. This memory disclosure could expose sensitive information to any recipient on the CAN bus, potentially compromising confidentiality. There is no indication of privilege escalation, denial of service, or integrity impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, consider restricting access to the CAN bus and UDP datagrams that could trigger this vulnerability to trusted sources only.