Technical impact
A defect in the SAE_J1939_Read_Binary_Data_Transfer_DM16 routine of Open-SAE-J1939 allows an attacker to send a specially crafted CAN frame that causes the library to enter an error state and stop processing legitimate traffic, resulting in a denial of service. The flaw originates from insufficient validation of the incoming data field in the DM16 packet, leading to an unchecked condition that halts the receiving loop. The impact is restricted to the device or system that runs this implementation, causing loss of J1939 bus functionality until the process is reset.
Affected Systems
Open‑SAE‑J1939 is the only affected project; the vulnerability applies to any product that incorporates the library unchanged and runs a J1939 stack that uses the vulnerable commit b6caf884df46435e539b1ecbf92b6c29b345bdfe.
Risk and Exploitability
Based on the description, it is inferred that an attacker must have physical or logical access to inject a malicious CAN frame, limiting the risk surface to components connected to the J1939 network. The CVSS score is 7.5 and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation in the wild. Nevertheless, because the denial of service can halt critical engine management or safety systems, the potential impact on safety and operational continuity is significant. The threat is plausible in environments where J1939 traffic is not inspected or rate‑limited.
