CVE-2026-70388
Memory Corruption via Integer Underflow in Message Length Validation
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
0th
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.
| CWE | CWE-191 CWE-195 CWE-787 |
| Vendor | rt-labs ab |
| Product | soem |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for rt-labs ab soem
Be the first to know when new high vulnerabilities affecting rt-labs ab soem are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High
Affected Versions
RT-Labs AB / SOEM
0 < 2.0.1
References
Credits
alosafuzz, 3ntr0py1337 / LeetProtect Research, Brian Willows / graith.co.uk, Eun0us / EspilonOrg, Mayur Agnihotri