CVE-2026-82945: Memory Corruption via FMMU Configuration Table Overflow
SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of ECMAXFMMU entries. A device presenting more than ECMAXFMMU configuration blocks can force writes beyond the array boundary, corrupting adjacent memory structures and potentially disrupting subsequent operations.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
SOEM 2.0.0 and earlier are affected during device configuration. Exposure requires the SOEM instance to configure a malicious device that can present more than EC_MAXFMMU configuration blocks.
Does exploiting this require authentication or user interaction?
No privileges or user interaction are required according to the supplied CVSS vector. The attacker needs network-adjacent access and control of, or the ability to impersonate, a device involved in configuration.
What is the likely operational impact?
The out-of-bounds writes can corrupt adjacent memory structures and disrupt subsequent operations. The provided CVSS vector indicates high availability impact, with no stated confidentiality or integrity impact.