COVESA Open1722 contains a stack buffer overflow in the avtp_to_can() function used by the acf-can-listener service. The function writes past the end of a fixed 15‑slot array when it receives more than 15 ACF‑CAN messages in a UDP datagram. Because the function increments its write index unchecked and the listener accepts datagrams from any sender that matches a hard‑coded unauthenticated stream ID, an attacker can corrupt adjacent stack memory and subsequently gain arbitrary code execution or cause a denial of service. This flaw is a classic stack overrun, classified as CWE‑121.

The vulnerable code is released under the COVESA brand as the Open1722 project. All releases through version 0.9.2 are affected. The flaw is present in the open‑source implementation that parses UDP traffic for the acf‑can‑listener component.

The vulnerability has a CVSS score of 8.7, indicating high severity. The EPSS score is 2%, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the weakness remotely by crafting and sending an oversized UDP datagram from any IP address, as the listener accepts traffic without authentication or authorization checks. Because the stream ID is transmitted in plaintext, no privileged credentials are required to trigger the overflow. The lack of bounds checking on array writes makes exploitation straightforward for an attacker who can direct traffic to the target host.