---
id: "CVE-2026-82946"
kind: "vulnerability"
aliases: ["CVE-2026-82946"]
title: "SOEM: malicious EtherCAT device can crash master via cleared pointer"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded", "ethercat", "industrial-control", "package", "soem"]
not_affected_if: ["not-using-soem", "trusted-devices-only"]
published_at: "2026-10-26T09:16:36+00:00"
first_seen_at: "2026-10-26T09:29:16+00:00"
updated_at: "2026-10-26T09:30:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82946", "first_seen_at": "2026-10-26T09:29:16+00:00"}]
---

# SOEM: malicious EtherCAT device can crash master via cleared pointer

SOEM, an open-source EtherCAT master library, clears an internal pointer when it receives an error response but keeps processing. If a second message arrives before timeout, it dereferences the cleared pointer and crashes. An attacker controlling a device on the bus can crash the master with two messages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project uses SOEM by searching dependencies and sources for `ec_init` or `soem` (unknown for exact version lookup from the sources)
- Confirm the SOEM version in use; the sources say 2.0.0 and earlier are affected

## Fix

- Upgrade SOEM past `2.0.0` to a release that includes the fix (the fixed version is unknown from the sources)
- Until patched, restrict which devices can attach to the EtherCAT bus (unknown whether this is sufficient)

## Timeline

- 2026-10-26T09:29:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82946

## From the sources

SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_