CVE-2026-42485 affects AGL agl-service-can-low-level's uds-c library with a stack buffer overflow vulnerability. The send_diagnostic_request function in uds.c allocates a 6-byte buffer but copies up to 7 bytes via memcpy, causing 1-4 bytes of controlled stack overflow. The payload_length field lacks bounds checking against the destination buffer. On 32-bit ARM automotive ECUs without stack canaries, this vulnerability can lead to return address overwrite and remote code execution. The vulnerability specifically impacts automotive systems running Automotive Grade Linux (AGL).