---
id: "CVE-2026-82944"
kind: "vulnerability"
aliases: ["CVE-2026-82944"]
title: "SOEM: multi-segment transfers let a malicious device overflow memory buffers"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "ethercat", "industrial-control", "infrastructure", "soem"]
not_affected_if: ["no-ethercat-master", "soem-not-used"]
published_at: "2026-10-26T09:16:36+00:00"
first_seen_at: "2026-10-26T09:29:16+00:00"
updated_at: "2026-10-26T09:30:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82944", "first_seen_at": "2026-10-26T09:29:16+00:00"}]
---

# SOEM: multi-segment transfers let a malicious device overflow memory buffers

SOEM (Simple Open EtherCAT Master) version 2.0.0 and earlier checks the total transfer size only once, at the start of a multi-segment transfer, and does not track cumulative size as segments arrive. A malicious EtherCAT device can declare a small initial size, pass validation, then send further segments that write controlled data past the buffer, potentially enabling code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the SOEM version in use; versions `2.0.0` and earlier are listed as affected.
- unknown

## Fix

- Upgrade SOEM to a release newer than `2.0.0`; the fixed version is not named in the sources.
- unknown

## Timeline

- 2026-10-26T09:29:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82944

## From the sources

SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_