COVESA Open1722 versions up to 0.9.2 are affected by an integer truncation flaw in acf‑can‑listener.c that allows an unauthenticated attacker to cause the CAN listener to transmit process stack memory onto the CAN bus. The vulnerability occurs when a rejected AVTP datagram containing a matching AVTP stream ID is received; the num_can_msgs variable, declared as a uint8_t, truncates the -1 error return value from avtp_to_can() to 255. This causes the write loop to iterate 255 times over a 15‑slot stack array, leaking approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.

The affected product is COVESA’s Open1722, specifically version 0.9.2. No other versions or vendors are listed as impacted in the available data.

The CVSS score of 8.7 indicates a high severity vulnerability. An attacker with network access to the system can send a crafted UDP datagram with a rejected AVTP stream ID to trigger the memory disclosure. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that, while serious, there is no public evidence of widespread exploitation. The attack requires no privileged access and can be executed remotely, making it a significant threat to confidentiality for systems using the Open1722 CAN listener.