The flaw resides in the Handle_0x27_SecurityAccess function of the driftregion iso14229 library (versions up to 0.9.0). An integer underflow occurs when the function reads the sub‑function identifier from recv_buf[1] without first verifying that the request is at least two bytes long. When a remote unauthenticated attacker sends a single‑byte 0x27 SecurityAccess request that follows any prior well‑formed 0x27 message, the length calculation underflows, resulting in a 65535 value that is then used to copy or iterate over the receive buffer. This out‑of‑bounds read can trigger a crash of the UDS server and allows the attacker to read memory past the buffer boundary, exposing sensitive data. The issue is categorized as CWE‑125 and CWE‑191.

The vulnerable implementation is contained in driftregion’s iso14229 library prior to version 0.9.0. Devices that ship this library in automotive Electronic Control Units, industrial controllers, or general IoT systems and expose UDS over CAN, OBD‑II, ISO‑TP, or DoIP normally operate the SecurityAccess routine in the default diagnostic session without any prior authentication. Any deployment that includes iso14229 up to 0.9.0 and exposes the 0x27 sub‑function over those transports is therefore affected.

With a CVSS score of 7.8 the flaw is classified as high severity. The EPSS score indicates an exploitation probability of less than 1% (approximately 0.00459). The attack requires sending a crafted single‑byte packet that follows a valid SecurityAccess frame; this implies a relatively low to moderate exploitation probability in practice. The flaw is not yet listed in CISA’s KEV catalog, suggesting that large‑scale exploitation has not been documented. Nevertheless, an attacker on the vehicle‑bus network or with physical OBD‑II access can trigger the crash and potentially read memory, resulting in denial of service and transient information exposure.