Vulnerability · Published Oct 26, 2026 · Assigned by ENISA

CVE-2026-82947Multiple Out-of-Bounds Reads in Frame Processing

High 7.1

In plain English

A high-severity out-of-bounds read in SOEM from RT-Labs AB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 93.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.

Affected products (as reported)

Vendor	Product	Versions
RT-Labs AB	SOEM	0 – before 2.0.1

Weakness: CWE-125, CWE-787, CWE-191, CWE-129 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

References

https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf vendor-advisory