Automotive Grade Linux (Linuxfoundation) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 140 known versions, newest CVE from 2026-05-01. Vendor: Linuxfoundation.

CVEs of Automotive Grade Linux

• CVE-2026-37531 - CVSS 9.8 (critical), 2026-05-01: AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget…
• CVE-2026-37530 - CVSS 7.5 (high), 2026-05-01: AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a…
• CVE-2026-37526 - CVSS 7.8 (high), 2026-05-01: AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace,…
• CVE-2026-37532 - CVSS 7.1 (high), 2026-05-01: AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the…
• CVE-2026-37525 - CVSS 7.8 (high), 2026-05-01: AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call…