Live › vulnerability › CVE-2026-82944
Go to dashboardSOEM (Simple Open EtherCAT Master) version 2.0.0 and earlier checks the total transfer size only once, at the start of a multi-segment transfer, and does not track cumulative size as segments arrive. A malicious EtherCAT device can declare a small initial size, pass validation, then send further segments that write controlled data past the buffer, potentially enabling code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 09:29 UTC. All times on this page are UTC.
SOEM is used in EtherCAT master software that talks to industrial devices on a fieldbus, so the exposure is in controllers and automation systems that run SOEM and accept data from EtherCAT slave devices. The sources do not say which products bundle SOEM, and a team that does not run SOEM in an EtherCAT master can skip it. Exposure depends on whether the attacker can connect a malicious device to the bus or control an existing slave.
No product ranges from the sources yet.
2.0.0 and earlier are listed as affected.2.0.0; the fixed version is not named in the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-82944")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.