Linuxfoundation Automotive Grade Linux vulnerabilities

5 CVEs affecting Linuxfoundation Automotive Grade Linux, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-37532, published 2026-05-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-37531, published 2026-05-01. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename…
CVE-2026-37530, published 2026-05-01. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte stack buffer…
CVE-2026-37532, published 2026-05-01. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted…
CVE-2026-37526, published 2026-05-01. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without…
CVE-2026-37525, published 2026-05-01. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function in src/afb-supervision.c…