Open the hood of a new car and you won’t find much you can fix with a wrench. What you’ll find is software, and lots of it. The dashboard screen is probably running Android or a Linux variant. The system that monitors the road for you could be running QNX or VxWorks, the same kind of code that flies airplanes and runs factory floors.
Automakers have spent the last decade making this shift, giving them app stores, over-the-air updates, and faster release cycles. It also gave them something less welcome: all the old, publicly documented bugs that these platforms have collected over the years.
Researchers from Télécom SudParis decided to count this baggage. They built a scanner called VERA, pointed it at the operating systems in current cars and listed the known defects. The stack is big. It’s also more chaotic than the raw numbers suggest, which turns out to be the more interesting part of the story.
Table of Contents
What’s going on in your car?
First, researchers figured out who runs what, which is harder than it sounds because automakers treat these things as trade secrets. A 2023 BMW dashboard runs a Qualcomm chip equipped with automotive grade Linux and Android. GM and Cadillac are switching to Red Hat’s in-vehicle operating system for their 2026 models. Tesla has been quietly running Linux for years. When you line it all up, the fleet looks like a rolling collection of general-purpose computers connected to cellular, Wi-Fi, Bluetooth, and the car’s internal wiring.
Then they scanned it. The counts ended up all over the map. Automotive Grade Linux topped the list with 1,203 documented defects in the tested version. Android wasn’t far away. A leaner, security-focused stack called Eclipse S-CORE achieved a total of eight. Part of this gap is how much additional software each platform ships. Part of this is attention: popular open platforms are being denounced by more and more researchers, so more and more of their shortcomings are coming to light. Being looked at is its own form of exposure.
Certified does not mean it is bulletproof
You can expect the safety certified systems to come out clean. They don’t do that. QNX Neutrino has a reputable security certification and the tested build still logged 56 known vulnerabilities. VxWorks 7 has an even higher certification level and lands in the bottom dozen.
This is where certification does real work. It reduces the attack surface and enforces discipline in the creation of the code. However, it can’t prevent the mountain of surrounding software from spawning new bugs that someone needs to fix.
A large number is a to-do list, not a judgment
This is where the study gets honest with itself and many of the scary headlines fall flat. A logged security vulnerability may exist. It’s a vulnerability that could be significant under the right conditions, if the vulnerable code is enabled at all, the attacker can reach it, and the setup is randomly aligned. A thousand deficiencies mean a thousand things a defender needs to keep an eye on. It doesn’t mean a thousand trips in the car.
To show the difference, the team built two working attacks. One investigated a bug in SQLite, a database engine hidden in all sorts of apps that runs on Android Automotive. The other targeted a service discovery protocol called SOME/IP, and this one tells the whole story in a nutshell.
They carried out the same attack against three platforms. It worked on Red Hat’s AutoSD and Tesla’s software, allowing a service to be taken offline. It failed with Android Automotive, which the researchers believe was because the platform swapped its port numbers. One bug, three systems, two very different afternoons. Same level of severity on paper, and the outcome depended on which defenses were actually activated.
All of this ran in Docker containers on a lab bench, chosen because they are easy to reproduce. This setup determines the file system, installed packages and configuration. It skips the vendor’s custom kernel, firmware quirks, and hardware protections. The numbers describe what is included in the software image. You cringe at what’s happening in a car parked in your driveway.
The scanners have a car problem
Here too there is a working angle. The everyday scanners that security guards reach for assume a tidy system with a clean inventory of parts. Cars don’t play along. Trivy, one of the most popular images, has thrown up more than a thousand false positives for a single robotics image, but hardly anything useful for others. VERA builds on existing automotive reality tools and filters, eliminating bugs in command line utilities and developer tools that a locked car wouldn’t reveal at all. What you get back is shorter and sharper, a list that someone can actually work through rather than drown in.
So, here’s what you can get away with. The code in your car now shares a family tree and criminal record with the rest of the computing world. The length of that criminal record tells you how much there is to see. The real task is figuring out which of these old Beetles will ever let your particular car near anyone.
Download: The Ultimate Guide to Network Operations Management
https://www.helpnetsecurity.com/2026/07/24/car-research-automotive-software-vulnerabilities/
