Medium severity · published Oct 1, 2026
CVE-2026-82357
RT-Labs AB C-Open CANopen NULL pointer dereference
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
C-Open · RT-Labs AB
before 1.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82357
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82357
vendor-advisory
https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf
release-notes
https://github.com/rtlabs-com/c-open/releases/tag/public%2Fv1.1.1
third-party-advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json
vdb-entry
https://www.cve.org/CVERecord?id=CVE-2026-82357
More from C-Open
6.5
CVE-2026-82358
RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass