{"id":"CVE-2026-82944","kind":"vulnerability","aliases":["CVE-2026-82944"],"related":[],"title":"SOEM: multi-segment transfers let a malicious device overflow memory buffers","description":"SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.","summary":"SOEM (Simple Open EtherCAT Master) version 2.0.0 and earlier checks the total transfer size only once, at the start of a multi-segment transfer, and does not track cumulative size as segments arrive. A malicious EtherCAT device can declare a small initial size, pass validation, then send further segments that write controlled data past the buffer, potentially enabling code execution.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","ethercat","industrial-control","infrastructure","soem"],"not_affected_if":["no-ethercat-master","soem-not-used"],"how_to_check":"- Check the SOEM version in use; versions `2.0.0` and earlier are listed as affected.\n- unknown","fix":"- Upgrade SOEM to a release newer than `2.0.0`; the fixed version is not named in the sources.\n- unknown","status":"open","published_at":"2026-10-26T09:16:36+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","triaged_at":"2026-10-26T09:30:44+00:00","updated_at":"2026-10-26T09:30:44+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T09:30:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SOEM to a release newer than `2.0.0`; the fixed version is not named in the sources.\n- unknown","reach":"local","title":"SOEM: multi-segment transfers let a malicious device overflow memory buffers","impact":"high","summary":"SOEM (Simple Open EtherCAT Master) version 2.0.0 and earlier checks the total transfer size only once, at the start of a multi-segment transfer, and does not track cumulative size as segments arrive. A malicious EtherCAT device can declare a small initial size, pass validation, then send further segments that write controlled data past the buffer, potentially enabling code execution.","category":"infrastructure","nicknames":[],"who_cares":["ethercat","industrial-control","embedded","soem"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the EtherCAT master via buffer overflow","analyst_note":"Find the fixed SOEM version and the list of affected products in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-82944 and vendor advisories.","how_to_check":"- Check the SOEM version in use; versions `2.0.0` and earlier are listed as affected.\n- unknown","needs_analyst":true,"not_affected_if":["no-ethercat-master","soem-not-used"],"who_is_affected":"SOEM is used in EtherCAT master software that talks to industrial devices on a fieldbus, so the exposure is in controllers and automation systems that run SOEM and accept data from EtherCAT slave devices. The sources do not say which products bundle SOEM, and a team that does not run SOEM in an EtherCAT master can skip it. Exposure depends on whether the attacker can connect a malicious device to the bus or control an existing slave.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":3378,"output_tokens":654,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-82944':15A,18A '2.0.0':32B,89C 'addit':144C 'alloc':149C 'allow':152C 'arriv':59B,130C 'attack':132C,154C 'begin':119C 'beyond':159C 'boundari':161C 'buffer':12A,82B,108C,150C,160C 'check':35B,111C 'code':85B,164C 'contain':92C 'control':23B,78B,157C 'cumul':55B,125C 'cve':13A,16A 'data':79B,99C,158C 'declar':65B,134C 'devic':9A,63B,104C 'doesn':121C 'earlier':34B,91C 'embed':19B 'enabl':84B,163C 'ethercat':20B,29B,62B 'exceed':147C 'execut':86B,165C 'industri':22B 'industrial-control':21B 'infrastructur':24B 'initi':68B,137C 'let':6A 'malici':8A,61B,103C 'master':30B 'memori':11A,107C 'multi':3A,48B,97C 'multi-seg':2A,47B,96C 'multipl':128C 'open':28B 'overflow':10A,106C 'pass':70B,140C 'past':80B 'potenti':83B,162C 'segment':4A,49B,58B,75B,98C,129C,145C 'send':73B,143C 'simpl':27B 'size':39B,56B,69B,114C,126C,138C 'small':67B,136C 'soem':1A,25B,26B,87C 'softwar':110C 'start':44B 'total':37B,113C 'track':54B,123C 'transfer':5A,38B,50B,100C 'valid':71B,141C 'version':31B,88C 'vulner':94C 'write':77B,156C","nicknames":[],"mitigations":[],"who_affected":"SOEM is used in EtherCAT master software that talks to industrial devices on a fieldbus, so the exposure is in controllers and automation systems that run SOEM and accept data from EtherCAT slave devices. The sources do not say which products bundle SOEM, and a team that does not run SOEM in an EtherCAT master can skip it. Exposure depends on whether the attacker can connect a malicious device to the bus or control an existing slave.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82944","severity":null,"published_at":"2026-10-26T09:16:36+00:00","modified_at":"2026-10-26T09:16:36+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","fetched_at":"2026-10-26T09:29:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}