Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-82943medium6.5

Out-of-Bounds Read via Unchecked Length Values

Impact

SOEM version 2.0.0 and earlier has an out-of-bounds read vulnerability, allowing a malicious device to extract up to 64KB of data from the master's memory by sending messages with unchecked length values. The software fails to validate length values against actual buffer sizes. An attacker can exploit this to expose sensitive information.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

RT-Labs AB · ENISA

SOEM

1 range
ENISA version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

0 → before 2.0.1

semver versions

unaffected

unknown

Other versions: unaffected

Original source description

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-82943

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-125 ↗

CWE-125 Out-of-bounds read

ENISA

Related →
CWE-195 ↗

CWE-195 Signed to unsigned conversion error

ENISA

Related →
CWE-200 ↗

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

ENISA

Related →
Contributing organizations · 2
ENISA

Assigning organization

2026-10-26
CISA-ADP

Additional data publisher

2026-10-26

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

1 sources
rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf
vendor-advisoryENISA