CVE-2026-74238 | BDVDB-2026-360645 Detail

Description#

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-17Record published in the CVE List.
2. Version 22026-08-20Most recent update recorded in the CVE List.