CVE-2026-74238: TIER4 Nebula

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.

Affected products

• TIER4 Nebula: up to and including 1.2.0

Published 2026-08-17. Last modified 2026-09-24.