CVE-2026-111282GHSA-5hgv-5fqg-8vcrGHSA-ph4f-7v39-8hgm
iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer
driftregion iso14229
CVSS
8.8HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.10.1iso14229CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.
Text from CVE List
Affected versions 1
- iso14229affected: all versions before 0.10.1CVE List
References 7
- github.com/driftregion/iso14229/commit/2e36afcd7f0cd02b0c70446c1a265a7b1999d478Fixvia CVE List
- github.com/driftregion/iso14229/releases/tag/0.10.1%2B9e7c47e8Fixvia CVE List
- github.com/driftregion/iso14229/security/advisories/GHSA-ph4f-7v39-8hgmAdvisoryvia CVE List
- vulncheck.com/advisories/iso14229-before-0.10.1-out-of-bounds-read-via-handle-0x38-requestfiletransferAdvisoryvia CVE List
- github.com/driftregion/iso14229/security/advisories/GHSA-5hgv-5fqg-8vcrExploitvia CVE List
- github.com/driftregion/iso14229/blob/0.10.0/src/server.c#L1151-L1161Referencevia CVE List
- github.com/driftregion/iso14229Referencevia CVE List