The vulnerability is an integer wraparound in Handle_0x38_RequestFileTransfer in iso14229, allowing unauthenticated attackers to bypass a file path length check. This can cause the server to read beyond its receive buffer, leading to crashes or disclosure of sensitive memory contents. The weakness is a classic out‑of‑bounds read (CWE-190).

The affected product is Driftregion's iso14229 library, any release prior to 0.10.1 including 0.10.0. All environments that use the library to handle RequestFileTransfer requests are potentially impacted; no other components are listed as affected.

The CVSS score of 8.8 indicates high severity. EPSS is very low, approximately 0.00474 (< 1%), and the issue is not listed in KEV. It is inferred that the attack vector is remote, as attackers can send short RequestFileTransfer packets over the network without authentication. Given the high score, the risk should be considered significant, especially in exposed deployments.