PT-2026-115273

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle 0x38 RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer SID 0x38 request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks t...