The vulnerability is a classic buffer overflow in the main function of socketcand version 0.4.2. A maliciously crafted bus_name can overrun an internal buffer, leading to a corrupted stack or memory area. The immediate consequence is a denial of service, and depending on the execution context, an attacker might achieve further compromise.

The only product explicitly identified is the open‑source socketcand utility, version 0.4.2. No other vendor or product is listed, and the CNA has not supplied affected‑version details beyond the single release.

The CVSS score is 7.5, indicating a high severity. EPSS data is missing, and the vulnerability is not in CISA’s KEV list. The attack vector is inferred to be local or remote depending on whether an attacker can send a malformed bus_name to the socketcand service. Even without an official patch, the risk of a denial of service is high for systems that rely on socketcand for communication.