What’s Vulnerable › Vulnerabilities
CVE-2026-82946: Null Pointer Dereference in Mailbox Error Handling
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-26 · updated 2026-10-26
- Weakness: CWE-476
Description
SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.
Affected products
- RT-Labs AB SOEM: before 2.0.1 — fixed in 2.0.1
How to fix
Upgrade to a fixed version: RT-Labs AB SOEM 2.0.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-82946 or the next vulnerability affects your stack