SOEM: Out-of-bounds memory read vulnerability (CVE-2026-82947)
The Simple Open EtherCAT Master (SOEM) library version 2.0.0 and earlier fails to validate length and offset fields in device messages, allowing a malicious device to trigger out-of-bounds memory reads.
CVE search metadata
CVE search record: CVE-2026-82947. Severity: high. CVSS: 7.1. KEV: no. Product: SOEM (<= 2.0.0). Brief: SOEM: Out-of-bounds memory read vulnerability (CVE-2026-82947). Brief link: https://feed.craftedsignal.io/briefs/2026-10-soem-memory-safety/
Triage facts
Revision 1- Applicability
- SOEM (<= 2.0.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 09:41 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A5Roughly even chance
CVE-2026-82947 involves a memory safety vulnerability in the SOEM frame processing logic. An attacker-controlled device can provide manipulated length and offset values within EtherCAT messages. Because the master does not validate these inputs against allocated buffer sizes, it performs out-of-bounds reads. This flaw can lead to sensitive information disclosure or a denial-of-service condition via application crashes.
Impact
Successful exploitation may result in the disclosure of memory contents to an attacker or an unexpected crash of the master process.
Recommendation
Identify systems utilizing the SOEM library version 2.0.0 or earlier. Monitor for unusual application crashes or logs indicative of memory access violations in the EtherCAT master service. Upgrade to a patched version once released by the maintainers.
Threat Hunt
Monitor for repeated segmentation faults or crashes of services utilizing the SOEM library.
Data: Application crash logs, System event logs (e.g., dmesg, Windows Event Log)
Mitigations
Identify and inventory all deployments of SOEM 2.0.0 or earlier.
CVE-2026-82947