The vulnerability is a stack-based buffer overflow caused by the absence of validation on the phdr.len field in the Open Vehicle Monitoring System 3 (OVMS3) PCAP parser. When an attacker sends a malicious Pcap file containing an oversized length, the parser writes beyond the bounds of the destination buffer, potentially crashing the service or allowing arbitrary code execution. This flaw therefore threatens the availability and integrity of the OVMS3 process, and if exploited, could give remote control over the vehicle monitoring system.

This defect is present in Open Vehicle Monitoring System 3 release 3.3.005, the only version explicitly identified as affected. Deployments of this release, regardless of vendor distribution, are impacted. Earlier or later versions are not reported to contain the same unvalidated length check.

The EPSS score is not available and the flaw is not listed in CISA's KEV catalog, so the precise likelihood of exploitation is unknown. Nonetheless, the description indicates the vulnerability can be triggered remotely via a crafted Pcap file, and the potential for remote code execution categorises the risk as high. The CVSS score of 8.8 indicates a critical severity vulnerability. Attackers would simply need to supply a Pcap input that deliberately exceeds the expected header length; no special conditions beyond that are described, making the exploit path realistic for a determined adversary.