Vulnerability · Published Oct 1, 2026 · Assigned by cisa-cg

CVE-2026-82357RT-Labs AB C-Open CANopen NULL pointer dereference

Medium 6.5

In plain English

A medium-severity null pointer dereference in C-Open from RT-Labs AB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 78.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.

Affected products (as reported)

Vendor	Product	Versions
RT-Labs AB	C-Open	0 – before 1.1.1

Weakness: CWE-476 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

url vendor-advisory
url release-notes
url third-party-advisory
url vdb-entry