CVE-2026-82946: Null Pointer Dereference in Mailbox Error Handling
SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using RT-Labs SOEM version 2.0.0 or earlier are affected when they communicate with a malicious device capable of sending mailbox error responses and follow-up messages.
Does exploitation require credentials or user interaction?
No. The supplied vector indicates adjacent-network attack access, low attack complexity, no privileges, and no user interaction.
What is the practical impact of a successful attack?
A malicious device can crash the SOEM master system, causing a denial of service. The provided impact information indicates no confidentiality or integrity impact.
What message sequence triggers the crash?
The attacker sends an error response that causes SOEM to clear an internal pointer, then sends another message before the timeout expires. Processing the second message dereferences the cleared pointer and crashes the master.