CVE-2026-81575
Missing Sanity Checks for Buffer Lengths
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.
| CWE | CWE-130 |
| Vendor | wibu-systems-ag |
| Product | codemeter-runtime |
| Published | Aug 27, 2026 |
| Last Updated | Aug 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for wibu-systems-ag codemeter-runtime
Be the first to know when new high vulnerabilities affecting wibu-systems-ag codemeter-runtime are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
wibu-systems-ag / codemeter-runtime
9.00 < 9.10 8.00 < 8.41a
References
Credits
🔍 Andrew Teylu of Vector Informatik GmbH