---
id: "CVE-2026-82943"
kind: "vulnerability"
aliases: ["CVE-2026-82943"]
title: "SOEM: malicious device responses let the master read past buffers"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "ethercat", "industrial-automation", "infrastructure", "soem"]
not_affected_if: ["isolated-trusted-bus", "not-using-soem"]
published_at: "2026-10-26T09:16:36+00:00"
first_seen_at: "2026-10-26T09:29:16+00:00"
updated_at: "2026-10-26T09:30:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82943", "first_seen_at": "2026-10-26T09:29:16+00:00"}]
---

# SOEM: malicious device responses let the master read past buffers

SOEM, an EtherCAT master library, trusts length values in device responses without checking them against buffer sizes. A malicious device on the network can make the master read up to 64KB of its own memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the SOEM version in use is `2.0.0` or earlier, for example by reading the version in the project's build files or vendored source
- Check whether the master runs on a network segment where untrusted or rogue EtherCAT devices can connect

## Fix

- Upgrade SOEM past `2.0.0` once a fixed release is published; the sources do not name the fixed version
- Until then, keep untrusted devices off the EtherCAT network segment

## Timeline

- 2026-10-26T09:29:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82943

## From the sources

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_