CVE-2026-74238TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder
Updated under an hour ago ()
Does this affect you?
It affects tier4 nebula. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-125
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Aug 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
tier4 nebula tier4:nebula (from the name) | through 1.2.0 | CNA record |
References
- https://github.com/tier4/nebula/issues/488issue-tracking
- https://www.vulncheck.com/advisories/tier-iv-nebula-heap-out-of-bounds-read-via-vlp32-udp-decoderthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.