Researchers Find Hundreds of Automotive Software Vulnerabilities
A new study reveals that external applications contribute significantly to software risks in modern vehicle development.
Updated on Oct. 30, 2026 in Auto Parts
Live Poll
Do you trust the security of your car's connected apps and entertainment systems?
Researchers at the University of Gothenburg and Chalmers University of Technology identified 827 vulnerable libraries across 20 open-source projects used in the automotive industry. Their analysis of 413 reported vulnerabilities found that over one-third originated from external applications.
Why it matters
The findings highlight critical security gaps in the software supply chain as vehicles become increasingly digitized. Identifying these flaws is essential to preventing potential unauthorized access and improving cybersecurity across the global automotive sector.
The study identified 827 vulnerable libraries within 20 open-source projects examined by researchers. Additionally, 17 of the analyzed flaws appear in the official US cybersecurity catalog of known exploited vulnerabilities.
The players
University of Gothenburg
This public research university based in Sweden collaborated on the vulnerability study.
Chalmers University of Technology
This Swedish technical university focuses on research and education in technology and natural sciences.
The details
By using five separate scanning tools to audit open-source projects, the team discovered that most vulnerabilities originated during the code-writing stage. The researchers cross-checked their findings against records from the US National Vulnerability Database to verify the severity of the flaws.
Timeline
The analysis covered automotive software vulnerabilities recorded from January 2022 to September 2024.
Researchers cited the 2015 demonstration of remote access to a Jeep Cherokee as context for long-term security concerns.
Previous academic research on automotive vulnerabilities focused on the period between 2010 and 2019.
Roadmap
This research reflects a broader shift toward securing the complex software supply chains required for modern connected vehicles. It marks a departure from earlier concerns, focusing now on systemic library vulnerabilities rather than isolated remote exploits.
While this research does not immediately affect individual drivers, it necessitates stricter cybersecurity audits for new vehicle software. Owners may eventually see enhanced over-the-air update requirements to patch these vulnerable libraries in existing systems.
The takeaway
Vehicle manufacturers are increasingly reliant on third-party code that can introduce significant security risks to the car's operating system. Addressing these vulnerabilities during the initial coding stage is now a critical step for maintaining long-term vehicle safety.
Further reading
For more on industry software standards, visit the Auto Parts section.
Live Poll
Do you trust the security of your car's connected apps and entertainment systems?
