A classic buffer overflow in the CAN frame parsing logic of cannelloni makes the application overwrite memory when handling malformed CAN FD frames. The vulnerability allows attackers to crash the service, causing a denial of service, or to execute arbitrary code if the memory overwrite grants sufficient control. The weakness is a stack-based buffer overflow, which directly violates integrity by overwriting return addresses or function pointers. The impact range includes any system running the vulnerable cane version exposed to external CAN traffic.

The affected product is cannelloni version 2.0.0. No other vendors or products are listed by the CNA, so any system running that exact version of the software, particularly where it processes external CAN frames, is susceptible.

The CVSS score of 9.8 indicates a critical severity, and although the EPSS score is not available, the lack of a KEV listing does not mitigate the high risk. The attack vector is inferred to be remote, as attackers craft malicious CAN FD frames that the vulnerable parser processes. To exploit, an attacker must be able to inject such frames towards the vulnerable system, a realistic scenario for embedded automotive or industrial control environments that interface with CAN networks.