CVE-2026-56790

CANBoat - Off-by-One Global Buffer Overflow in searchForPgn()

Published Jun 25, 2026 CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Description

CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overflow in the searchForPgn() function in analyzer/pgn.c that allows remote attackers to crash the application. Attackers can deliver a crafted NMEA-2000 message with an out-of-range PGN value over CAN bus or N2K-over-IP to trigger an out-of-bounds array access and denial of service.

Analysis

Technical impact

The vulnerability is an off‑by‑one out‑of‑bounds array access in the searchForPgn() routine of CANBoat. This flaw allows attackers to crash the application, resulting in a denial of service to the CAN‑bus interface and any dependent systems. The weakness is classified as CWE‑193, indicating a classic off‑by‑one error.

Affected Systems

CANBoat versions up to and including 6.22 are affected. The problem exists in the analyzer/pgn.c component of the software. A fix is provided in the commit a5a22b74b9ace which addresses the buffer overflow.

Risk and Exploitability

The CVSS score of 7 indicates noteworthy severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the crash remotely by sending a crafted NMEA‑2000 message with an out‑of‑range PGN value over CAN bus or N2K‑over‑IP. The attack requires network access to the CAN‑bus interface, but does not require special credentials.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

canboat

unaffected

Version	Status	Constraints
`0`	affected	≤ 6.22
`a5a22b74b9ac5688019cba62669df08562cebd6f`	unaffected	—

No data.

Vendor Product Versions

Canboat

Version	Status	Scheme	Platform
`[0,6.22]`	affected	generic	—
`a5a22b74b9ac5688019cba62669df08562cebd6f`	unaffected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update CANBoat to the version containing commit a5a22b74b9ac5688019cba62669df08562cebd6f or later, ensuring the off‑by‑one buffer overflow fix is applied.
Rebuild and redeploy the updated CANBoat binaries on all affected nodes, then restart the service to use the patched code.
Confirm that the service no longer crashes when receiving invalid PGN values by reproducing the attack vector in a controlled environment or using automated monitoring for unexpected terminations.

Generated by OpenCVE AI on June 25, 2026 at 19:35 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.309% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/canboat/canboat/commit/a5a22b74b9ac5688019cba62669df08562cebd6f
https://github.com/canboat/canboat/issues/644
https://github.com/canboat/canboat/pull/649
https://www.vulncheck.com/advisories/canboat-off-by-one-global-buffer-overflow-in-searchforpgn

History

Jun 26, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 26, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Canboat Canboat canboat
Vendors & Products		Canboat Canboat canboat

Jun 25, 2026 6:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overflow in the searchForPgn() function in analyzer/pgn.c that allows remote attackers to crash the application. Attackers can deliver a crafted NMEA-2000 message with an out-of-range PGN value over CAN bus or N2K-over-IP to trigger an out-of-bounds array access and denial of service.
Title		CANBoat - Off-by-One Global Buffer Overflow in searchForPgn()
Weaknesses		CWE-193
References		https://github.com/canboat/canboat/commit/a5a22b74b9ac5688019cba62669df08562cebd6f https://github.com/canboat/canboat/issues/644 https://github.com/canboat/canboat/pull/649 https://www.vulncheck.com/advisories/canboat-off-by-one-global-buffer-overflow-in-searchforpgn
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H'}` cvssV4_0 `{'score': 7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N'}`