CVE-2026-82357

MEDIUM 6.5

RT-Labs AB C-Open CANopen NULL pointer dereference

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.

CWE	CWE-476
Vendor	rt-labs ab
Product	c-open
Published	Oct 1, 2026

Stay Ahead of the Next One

Get instant alerts for rt-labs ab c-open

Be the first to know when new medium vulnerabilities affecting rt-labs ab c-open are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

RT-Labs AB / C-Open

0 < 1.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

rt-labs.com: https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf github.com: https://github.com/rtlabs-com/c-open/releases/tag/public%2Fv1.1.1 raw.githubusercontent.com: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json cve.org: https://www.cve.org/CVERecord?id=CVE-2026-82357

Credits

f0rw4rd, quellsec.dev