A buffer overflow in Open Vehicle Monitoring System 3 (version 3.3.005) occurs when the parser of canformat_canswitch.cpp fails to validate a CANswitch DLC value, allowing a remote attacker to supply a malformed frame. The overflow can cause a crash, resulting in denial of service, or if the overflow is exploited successfully, arbitrary code execution on the OVMS3 device. This vulnerability is a classic stack‑based buffer overflow, permitting loss of confidentiality, integrity, and availability.

The vulnerability affects only the Open Vehicle Monitoring System 3, specifically the 3.3.005 release. No vendors or additional product lines are listed as affected, and no CPE strings are provided.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The likely attack vector, based on the description, is that an attacker would need the ability to inject CANswitch frames onto the vehicle’s CAN bus, which typically requires physical or network access to the bus. The vulnerability is not listed in the CISA KEV catalog, and no publicly known exploits are cited. Nevertheless, the potential for remote code execution warrants swift action.