CVE-2026-74238 is an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function of TIER IV Nebula through version 1.2.0. The vulnerability arises because the Velodyne UDP sensor port does not enforce sender-address restrictions, allowing unauthenticated attackers to send malformed short UDP datagrams. This causes the decoder to read past the end of the UDP buffer into adjacent heap memory, leading to fabricated points being silently published in downstream PointCloud2 messages used by Autoware nodes.

An unauthenticated remote attacker can exploit this vulnerability by sending a short UDP datagram to the Velodyne UDP sensor port, causing the decoder to read out-of-bounds heap memory. This results in fabricated point cloud data being published to downstream consumers, potentially impacting the integrity of sensor data processing in autonomous vehicle systems relying on Autoware nodes. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating a significant risk due to network attack vector, no required privileges or user interaction, and high impact on integrity.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the Velodyne UDP sensor port to trusted sources to mitigate unauthenticated remote exploitation.