SOEM: Memory corruption via integer underflow in message length validation
Summary
SOEM (Simple Open EtherCAT Master), an open source EtherCAT master library, does not properly validate message length values. A malicious or compromised device on the same EtherCAT network can send crafted messages that make the master write outside allocated memory. This can corrupt memory and potentially allow arbitrary code execution on the master system. No authentication is required, but the attacker must be on the EtherCAT segment.
Affected
- SOEM versions prior to 2.0.1 (CVE record: 0 to < 2.0.1; the CVE description mentions 2.0.0 and earlier)
- Products that embed SOEM: unknown, ask your machine or software vendors
Fixed in
- SOEM 2.0.1 (per the vendor advisory RRTL-260921-01)
- Verify the 2.0.1 tag on the official GitHub repository, as it could not be confirmed there at the time of research
Workaround
Unknown. The CVE record and the vendor advisory name no workaround; upgrading to SOEM 2.0.1 or later is the only stated remedy.
Exploitation
- No confirmed exploitation in the wild found
- Not listed in CISA KEV
- No public proof of concept found
- EPSS below 1 percent
- One threat intelligence source claims attack traffic was observed; this could not be verified
Our recommendation
- Find out whether any installed machine, controller or software bundles SOEM
- Ask the vendors for affected versions and a patch plan, and apply SOEM 2.0.1 or later where possible
- If patching is not possible, restrict which devices can join the EtherCAT segment
- Keep the EtherCAT segment separate from office IT networks and the internet
- Monitor the segment for unexpected devices and traffic
- Note: VulDB rates the issue 7.3 with CWE-770, while NVD rates it 8.3; plan using the NVD score
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- RT-Labs advisory RRTL-260921-01 rt-labs.com
- OpenCVE: CVE-2026-70388 app.opencve.io
- Strix: CVE-2026-70388 www.strix.ai
- VulDB entry 426336 vuldb.com
- OffSeq threat radar entry radar.offseq.com
- SOEM GitHub releases github.com
- RT-Labs: SOEM v2.0 major release rt-labs.com
- SOEM GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:14.
Original description (NVD)
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.