RT-Labs SOEM: Buffer overflow in multi-segment CoE SDO upload
Summary
RT-Labs SOEM, a library for EtherCAT MainDevices used in embedded and industrial systems, contains a buffer overflow in the handling of multi-segment data transfers. The total size is checked only once at the start, so a malicious EtherCAT device can declare a small size and then send further segments that write beyond the allocated buffer. Successful exploitation may allow code execution in the process that runs the master. The attacker must be on the EtherCAT or local machine network and act as a malicious device.
Affected
- SOEM versions 0 to before 2.0.1 (CVE record: affected 0 to < 2.0.1)
- SOEM 2.0.0 and earlier according to the vulnerability description
- Products or machine software that embed a vulnerable SOEM version
Fixed in
- Upgrade to SOEM 2.0.1 or later (according to the CVE record data; confirm the fixed version in vendor advisory RRTL-260921-01)
Workaround
- No vendor workaround is documented. Upgrading is the recommended remedy.
- Until the patched version is deployed: keep the EtherCAT fieldbus on a segregated network, allow only known slave devices, and restrict physical and switch-port access to the machine network.
Exploitation
- No known exploitation (not listed in CISA KEV; OffSeq reports not known to be exploited).
- No public proof of concept found.
- EPSS below 1% (very low predicted likelihood).
- Attack requires adjacent network access and acting as a malicious EtherCAT device.
Our recommendation
- Check whether SOEM is used directly or embedded in machine or integrator software, and ask suppliers which SOEM version they ship.
- Plan the upgrade to SOEM 2.0.1 or later as part of the normal maintenance cycle, after confirming the fixed version in the vendor advisory.
- Verify that the EtherCAT network is segregated and that only known slave devices are connected.
- Prioritise this for OT and industrial environments with EtherCAT; IT-only networks without EtherCAT are low priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- RT-Labs advisory RRTL-260921-01 rt-labs.com
- OpenCVE: CVE-2026-82944 app.opencve.io
- VulDB: CVE-2026-82944 vuldb.com
- OffSeq Radar: CVE-2026-82944 radar.offseq.com
- INCIBE-CERT: CVE-2026-82944 www.incibe.es
- SOEM GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:33.
Original description (NVD)
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.