CVE-2026-82946
SOEM: Null Pointer Dereference in Mailbox Error Handling
RT-Labs AB SOEM
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 2.0.1SOEMCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.
Text from CVE List
Affected versions 1
- SOEMaffected: all versions before 2.0.1CVE List