A buffer overflow occurs in the Open Vehicle Monitoring System 3 when processing GVRET frames, because the length field within the binary payload is not properly validated. This flaw can be exploited by a remote attacker who sends a crafted GVRET frame, potentially leading to a denial of service or the execution of arbitrary code on the target system. The description explicitly states that the vulnerability may allow attackers to cause arbitrary code execution, indicating a high severity risk to confidentiality, integrity, and availability of the vehicle monitoring service.

The vulnerability affects Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005. No other vendors or products are listed in the available data, so the risk is confined to systems running this specific OVMS3 release.

With a CVSS score of 10, the weakness is rated as critical, and although an EPSS score is not available, the high CVSS combined with the potential for remote code execution suggests a high likelihood of exploitation. The attack vector is inferred to be remote, requiring an attacker to transmit malicious GVRET frames to the OVMS device. Because the software runs on vehicle modules, the impact could compromise vehicle control functions if the vulnerability is leveraged for code execution.