{"id":"CVE-2026-70388","kind":"vulnerability","aliases":["CVE-2026-70388"],"related":[],"title":"SOEM: crafted network device messages can corrupt memory on master","description":"SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.","summary":"SOEM, an EtherCAT master library, has a flaw in how it handles message length values from network devices. A malicious device on the network can send crafted messages that make the master write outside allocated memory, which can corrupt memory and potentially run arbitrary code.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","ethercat","industrial-control","other","soem"],"not_affected_if":["isolated-network","no-soem"],"how_to_check":"- Check the SOEM version in the project, for example in the vendored source or the package manifest; versions 2.0.0 and earlier are affected\n- unknown whether the sources list a specific configuration that enables the flaw","fix":"- Move to a SOEM release newer than `2.0.0`; the sources do not name the fixed version\n- unknown whether a vendor patch or workaround is published","status":"open","published_at":"2026-10-26T09:16:35+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","triaged_at":"2026-10-26T09:30:49+00:00","updated_at":"2026-10-26T09:30:49+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T09:30:49Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a SOEM release newer than `2.0.0`; the sources do not name the fixed version\n- unknown whether a vendor patch or workaround is published","reach":"network","title":"SOEM: crafted network device messages can corrupt memory on master","impact":"high","summary":"SOEM, an EtherCAT master library, has a flaw in how it handles message length values from network devices. A malicious device on the network can send crafted messages that make the master write outside allocated memory, which can corrupt memory and potentially run arbitrary code.","category":"other","nicknames":[],"who_cares":["soem","ethercat","industrial-control","embedded"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker writes past buffers and may run code on the master","analyst_note":"Find the fixed SOEM version and any vendor advisory for CVE-2026-70388 on the NVD page or the project repository, since the sources give no fix or check details.","how_to_check":"- Check the SOEM version in the project, for example in the vendored source or the package manifest; versions 2.0.0 and earlier are affected\n- unknown whether the sources list a specific configuration that enables the flaw","needs_analyst":true,"not_affected_if":["no-soem","isolated-network"],"who_is_affected":"Systems running SOEM 2.0.0 or earlier as an EtherCAT master on a network where untrusted or compromised devices can send traffic. Teams that do not use SOEM, or whose masters sit on isolated fieldbus segments with no untrusted devices, face less exposure. The sources do not say which products embed SOEM.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000629,"input_tokens":3352,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-70388':13A,16A '2.0.0':71C 'alloc':58B,96C 'allow':110C,126C 'arbitrari':67B,131C 'arithmet':102C 'attack':128C 'boundari':98C 'bypass':117C 'caus':89C 'check':119C 'code':68B,132C 'contain':74C 'control':21B 'corrupt':7A,62B,122C 'craft':2A,50B,86C 'cve':11A,14A 'data':94C 'devic':4A,41B,44B,79C 'earlier':73C 'embed':17B 'ethercat':18B,26B 'execut':130C 'extrem':113C 'flaw':31B 'handl':35B 'industri':20B 'industrial-control':19B 'larg':114C 'length':37B,105C 'librari':28B 'make':53B 'malici':43B,78C 'master':10A,27B,55B,91C,135C 'memori':8A,59B,63B,97C,123C 'messag':5A,36B,51B,87C,104C 'negat':111C 'network':3A,40B,47B,82C 'outsid':57B,95C 'perform':101C 'potenti':65B,125C 'proper':108C 'run':66B 'safeti':118C 'send':49B,84C 'soem':1A,23B,24B,69C 'softwar':100C 'special':85C 'system':136C 'valid':109C 'valu':38B,106C,115C 'version':70C 'vulner':75C 'without':107C 'write':56B,93C","nicknames":[],"mitigations":[],"who_affected":"Systems running SOEM 2.0.0 or earlier as an EtherCAT master on a network where untrusted or compromised devices can send traffic. Teams that do not use SOEM, or whose masters sit on isolated fieldbus segments with no untrusted devices, face less exposure. The sources do not say which products embed SOEM.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-70388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70388","severity":null,"published_at":"2026-10-26T09:16:35+00:00","modified_at":"2026-10-26T09:16:35+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","fetched_at":"2026-10-26T09:29:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}