Memory Corruption via Integer Underflow in Message Length Validation

published 2026-10-26 14 d ago modified 2026-11-02 6 d ago also EUVD-2026-109659

cvss: 8.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.

Patch / fix

fixed in 1

RT-Labs AB SOEM 2.0.1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 6 d ago (2026-11-02)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.3	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Affected products

RT-Labs AB SOEM

Classification

Weakness

CWE-191 Integer Underflow (Wrap or Wraparound)
CWE-195 Signed to Unsigned Conversion Error
CWE-787 Out-of-bounds Write

References

rt-labs.com /wp-content/uploads/2026/10/RRTL-260921-01.pdf
vendor-advisory

Sources

CVE List CVE-2026-70388
NVD CVE-2026-70388

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary