A heap buffer over‑read exists in the isotp-c library’s isotp_continue_receive function, which extracts a 4‑bit payload length from a CAN frame. The function reads up to eight bytes beyond the end of the available data buffer when the extracted length is larger than the actual payload. This allows an adversary to read arbitrary memory contents from the heap and potentially reveal sensitive information.

The vulnerability is present in AGL agl-service-can-low-level through version 17.1.12, a component used by automotive Linux systems that expose CAN bus services.

The issue has a CVSS score of 7.1. EPSS is not available and the flaw is not listed in CISA KEV. An attacker who can inject CAN frames (for example, via a compromised vehicle interface) can send a crafted Single Frame message with an inflated payload length nibble, triggering the over‑read. Since the service does not validate the length against the actual data, the exploitation requires only local or remote access to the CAN network and does not rely on privilege escalation.