Vanetza V2X v26.02 Denial of Service (CVE-2026-37554)

advisory_vanetza_v2.md

# Vanetza V2X v26.02 — Denial of Service via Malformed V2X Messages

**Vendor**: Vanetza (github.com/riebl/vanetza)  
**Affected**: v26.02  
**Reporter**: Feng Ning, Innora Security Research (feng@innora.ai)  
**CVE**: CVE-2026-37554  
**CWE**: CWE-125 / CWE-476  
**CVSS**: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)  
**Disclosure**: 2026-04-30  

---

## Summary

Three distinct denial-of-service paths in Vanetza v26.02 allow a remote unauthenticated attacker to crash the stack using crafted V2X (ETSI ITS) messages. No authentication, no prior session — just malformed packets over the air.

---

## Vulnerability

Feeding malformed ETSI ITS payloads — CAM, DENM, or GeoNetworking headers — into Vanetza produces memory access errors and hard crashes. Two root causes account for all three paths: out-of-bounds reads in the message parsers, and NULL pointer dereferences in header processing when expected fields are missing.

None of these paths require anything beyond network adjacency. Any node on a V2X network can trigger them, as can an attacker injecting raw 802.11p frames. A receiving vehicle or roadside unit crashes; the stack goes down.

---

## Proof of Concept

AFL++ fuzzing across 41 cores for roughly 72 hours produced 3,988 unique crashes. Three minimized PoC inputs covering each path are available on request.

---

## Impact

Roadside units and vehicles running Vanetza for C-ITS message processing (CAM/DENM) are directly affected. An attacker within radio range — or injecting frames over 802.11p — can broadcast crafted messages that take the Vanetza stack offline, eliminating cooperative awareness in V2V and V2I deployments for as long as the attack continues.

---

*Innora Security Research — https://innora.ai*