Live › vulnerability › CVE-2026-82945
Go to dashboardSOEM, an open-source EtherCAT master library, writes device configuration data into a fixed-size array without bounds checking. A malicious device that presents more than EC_MAXFMMU configuration blocks can overwrite adjacent memory and disrupt later operations.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 09:29 UTC. All times on this page are UTC.
Teams that build or run systems using SOEM 2.0.0 or earlier as an EtherCAT master, typically industrial automation, robotics and embedded controllers. Exposure depends on whether the master accepts configuration from devices that could be malicious or compromised; systems that only talk to vetted, fixed hardware on an isolated bus have lower risk.
No product ranges from the sources yet.
EC_MAXFMMU and the device configuration code path to see if it is compiled in2.0.0; the sources do not name the fixed release, check the upstream SOEM repositoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device presenting more than EC_MAXFMMU configuration blocks can force writes beyond the array boundary, corrupting adjacent memory structures and potentially disrupting subsequent operations.
This page as .md · .json · in your agent: get_signal("CVE-2026-82945")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.