The vulnerability resides in the ISO-TP Single Frame receive handler of the openxc/isotp-c library. An out-of-bounds read occurs when the 4‑bit payload length nibble is used directly as the size argument to memcpy without being validated against the actual CAN data length. This flaw allows a crafted CAN frame with an inflated length nibble to trigger reads beyond the intended buffer, which can lead to a denial of service or disclosure of memory contents.

Any system that incorporates the openxc/isotp-c source code prior to commit 5a5d19245f65189202719321facd49ce6f5d46ac (dated 2021‑08‑09) is affected. This includes embedded automotive components, diagnostic tools, and other software that leverages this library for ISO‑TP communication over CAN.

The CVSS score of 7.1 indicates a medium to high severity level. Exploit probability is not quantified by EPSS and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a maliciously crafted CAN frame sent directly to the device running the vulnerable library. Successful exploitation would require the attacker to have a means to inject such frames onto the target's CAN bus, but no additional privilege escalation is implied by the data provided.