CVE-2026-82946 PUBLISHED

Null Pointer Dereference in Mailbox Error Handling

Assigner: ENISA
Reserved: 31.08.2026 Published: 26.10.2026 Updated: 26.10.2026

SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Product Status

Vendor RT-Labs AB
Product SOEM
Versions Default: unaffected
  • affected from 0 to 2.0.1 (excl.)

Credits

  • alosafuzz finder

References

Problem Types

  • CWE-476 NULL pointer dereference CWE
  • CWE-690 Unchecked Return Value to NULL Pointer Dereference CWE