76 Zero-day Vulnerabilities Uncovered by Hackers on Pwn2Own Automotive 2026

Security researchers at Pwn2Own Automotive 2026 disclosed 76 unique zero-day vulnerabilities across EV chargers and in-vehicle infotainment systems over a three-day contest in Tokyo, with $1,047,000 USD in bounties awarded. High-value findings included buffer overflows, command injection, hardcoded credentials, out-of-bounds reads/writes, and TOCTOU, potentially enabling remote code execution or vehicle manipulation; ZDI is coordinating vendor disclosure and patching.