CVE-2026-67560

Stack-based Buffer Overflow in Bendix EC80 Brake ECU

State: Published
Severity: 7.7 High
Published: Aug 27, 2026
Updated: Aug 28, 2026
Reserved: Aug 10, 2026

Description

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	icscert
3.1	7.5 High	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-121

Affected Products

Product	Versions
EC80ESP+ J1708Bendix	Z228999Affected Z300822Not affected
EC80ESP+ 6S/6MBendix	Z228999Affected Z300822Not affected
EC80ESP+ PLCBendix	Z228999Affected Z300822Not affected
EC80ESP+ 2nd CANBendix	Z228999Affected Z300822Not affected
EC80ESP+ Integrated TPMSBendix	Z228999Affected Z300822Not affected
EC80ESP 6S/6MBendix	Z266494Affected Z302578Not affected
EC80ESP PLCBendix	Z266494Affected Z302578Not affected
EC80ESP 2nd CANBendix	Z266494Affected Z302578Not affected
EC80ESP CAN GatewayBendix	Z266494Affected Z302578Not affected
EC80ESP 4S/4MBendix	Z286098Affected Z302579Not affected
EC80ESP PLCBendix	Z286098Affected Z302579Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.