Vulnerability · Published Oct 26, 2026 · Assigned by ENISA

CVE-2026-82946Null Pointer Dereference in Mailbox Error Handling

Medium 6.5

In plain English

A medium-severity null pointer dereference in SOEM from RT-Labs AB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 93.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.

Affected products (as reported)

Vendor	Product	Versions
RT-Labs AB	SOEM	0 – before 2.0.1

Weakness: CWE-476, CWE-690 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf vendor-advisory