Medium severity · published Oct 26, 2026
CVE-2026-82946
Null Pointer Dereference in Mailbox Error Handling
New
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
SOEM · RT-Labs AB
before 2.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82946
rt-labs.com
https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf
More from SOEM
8.8
CVE-2026-82944
Buffer Overflow in CoE SDO Upload Multi-Segment Data Transfers
8.3
CVE-2026-70388
Memory Corruption via Integer Underflow in Message Length Validation
7.1
CVE-2026-82947
Multiple Out-of-Bounds Reads in Frame Processing
6.5
CVE-2026-82945
Memory Corruption via FMMU Configuration Table Overflow
6.5
CVE-2026-82943
Out-of-Bounds Read via Unchecked Length Values