---
id: "CVE-2026-70388"
kind: "vulnerability"
aliases: ["CVE-2026-70388"]
title: "SOEM: crafted network device messages can corrupt memory on master"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["embedded", "ethercat", "industrial-control", "other", "soem"]
not_affected_if: ["isolated-network", "no-soem"]
published_at: "2026-10-26T09:16:35+00:00"
first_seen_at: "2026-10-26T09:29:16+00:00"
updated_at: "2026-10-26T09:30:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70388", "first_seen_at": "2026-10-26T09:29:16+00:00"}]
---

# SOEM: crafted network device messages can corrupt memory on master

SOEM, an EtherCAT master library, has a flaw in how it handles message length values from network devices. A malicious device on the network can send crafted messages that make the master write outside allocated memory, which can corrupt memory and potentially run arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the SOEM version in the project, for example in the vendored source or the package manifest; versions 2.0.0 and earlier are affected
- unknown whether the sources list a specific configuration that enables the flaw

## Fix

- Move to a SOEM release newer than `2.0.0`; the sources do not name the fixed version
- unknown whether a vendor patch or workaround is published

## Timeline

- 2026-10-26T09:29:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-70388

## From the sources

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_