Is CVE-2026-56790 actively exploited?

No active exploitation of CVE-2026-56790 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-56790 be exploited remotely?

No. CVE-2026-56790 requires local access to exploit.

What is the CVSS score of CVE-2026-56790?

CVE-2026-56790 has a CVSS score of 7.3 (HIGH).

HOME VULNERABILITIESCVE-2026-56790

HIGH

CVE-2026-56790

CWE-193Published: June 25, 2026· Updated: Jun 26, 2026

7.3

CVSS v3.1

EPSS:0.21%probability of exploitation in 30 daysPercentile:11.9th

Official Description

CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overflow in the searchForPgn() function in analyzer/pgn.c that allows remote attackers to crash the application. Attackers can deliver a crafted NMEA-2000 message with an out-of-range PGN value over CAN bus or N2K-over-IP to trigger an out-of-bounds array access and denial of service.

NVD Source

Technical Analysis

CVE-2026-56790 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.3.