A stack buffer overflow occurs in the uds.c component of Automotive Grade Linux's agl-service-can-low-level. The send_diagnostic_request function allocates a 6-byte buffer but copies up to 7 bytes, creating a 1-4 byte overflow that overwrites adjacent stack memory. Because the payload length field is unchecked, an attacker can overwrite the return address on 32-bit ARM ECUs lacking stack canaries, enabling execution of arbitrary code.

Systems running Automotive Grade Linux's agl-service-can-low-level through version 17.1.12 are affected. The flaw is present in the Unified Diagnostic Services implementation that handles diagnostic requests received over the vehicle’s CAN bus. The vulnerability is specific to 32-bit ARM automotive ECUs that do not employ stack canaries, and no patch is publicly available in the current release at the time of this analysis.

The CVSS score of 7.5 indicates a high severity, but no EPSS data is available and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to inject crafted diagnostic requests onto the vehicle’s CAN network and the target ECU must expose an unprotected UDS service on an ARM Cortex-A processor without stack protection. If these conditions are met, a return-address overwrite could lead to remote code execution with the privileges of the ECU firmware.