The flaw is an integer underflow in Handle_0x27_SecurityAccess, where the library reads the SecurityAccess subFunction from recv_buf[1] without first ensuring that the request length is at least two bytes. When an attacker sends a single‑byte 0x27 request after any earlier well‑formed 0x27 message, the code subtracts a base length from a length of one, producing an unsigned underflow to 65535. That large value is then passed to callback functions that iterate or copy that many bytes from the receive buffer, causing an out‑of‑bounds read and a crash. The effect is a classic buffer‑overflow scenario that can also leak memory beyond the buffer, aligning with CWE‑125 (Out‑of‑Bounds Read) and CWE‑191 (Integer Underflow)."

The vulnerable implementation is contained in driftregion’s iso14229 library prior to version 0.9.0. Devices that ship this library in automotive Electronic Control Units, industrial controllers, or general IoT systems and expose UDS over CAN, OBD‑II, ISO‑TP, or DoIP normally operate the SecurityAccess routine in the default diagnostic session without any prior authentication. Any deployment that includes iso14229 up to 0.9.0 and exposes the 0x27 sub‑function over those transports is therefore affected.

With a CVSS score of 7.8 the flaw is classified as high severity. Although an EPSS score is not reported, the attack requires sending a crafted single‑byte packet that follows a valid SecurityAccess frame; this implies a relatively low to moderate exploitation probability in practice. The flaw is not yet listed in CISA’s KEV catalog, suggesting that large‑scale exploitation has not been documented. Nevertheless, an attacker on the vehicle‑bus network or with physical OBD‑II access can trigger the crash and potentially read memory, resulting in denial of service and transient information exposure.