CVE-2026-38719: Medium severity OpENer OpENer vulnerability

Published May 18, 2026

Updated

OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specifically in CreateCommonPacketFormatStructure() in source/src/enetencap/cpf.c. A crafted ENIP/CPF message can supply an attacker-controlled itemcount value that is not consistently validated against the remaining datalength of the CPF slice

Affected Software

1 affected component

OpENer OpENer=v2.3-558-g1e99582

Event History

May 18, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems running OpENer v2.3-558-g1e99582 that process attacker-supplied ENIP/CPF messages are exposed. The CVSS vector indicates exploitation requires local access, with no privileges or user interaction required.

What does an attacker need to do to trigger the flaw?

An attacker needs to provide a crafted ENIP/CPF message whose CPF item_count is attacker controlled and inconsistent with the remaining data_length of the CPF slice. This can cause an out-of-bounds read in CreateCommonPacketFormatStructure().

What is the likely security impact?

The reported CVSS vector rates availability impact as high, with no stated confidentiality or integrity impact. The issue is rated medium severity with a CVSS 3.1 score of 6.2.

CVE-2026-38719: Medium severity OpENer OpENer vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the flaw?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the flaw?

What is the likely security impact?