EUVD-2026-101948
GHSA-7m48-9f6m-vqh7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach driver over network
-
ExploitSend packet with malformed length field
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactCrash application (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the application/endpoint that uses the SICK Safetyscanners Base C++ driver to receive scanner protocol traffic; per AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or special non-default configuration is indicated. The practical limiting factors are: (1) the attacker must be able to deliver packets to the port/interface on which the driver parses incoming data, which in typical OT deployments means being on or routed into the industrial/scanner network segment rather than the open internet, and (2) the realized impact is bounded to a crash/denial-of-service - there is no confidentiality or integrity effect and no code execution, so network segmentation of the OT environment materially reduces real-world exposure. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 High) describes a remotely reachable, low-complexity, unauthenticated flaw, but the only impact is availability (A:H) - confidentiality and integrity are explicitly N, consistent with the description's 'application crash and denial-of-service' outcome. No EPSS score, CISA KEV listing, or POC/exploit-code signal was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This places the issue as a genuinely easy-to-trigger remote DoS rather than a code-execution or data-theft threat: the high base score is driven entirely by the availability impact and open attack vector, not by severity of consequence. Note a conflict worth verifying: the input Tags 'Information Disclosure' and 'Buffer Overflow' are inconsistent with CWE-125 (out-of-bounds READ) and the vector's C:N/I:N/A:H - an OOB read here manifests as a crash, not disclosure or memory corruption, so treat the tags as imprecise and rely on the CVSS vector and description. Real priority is moderate and context-dependent: for most IT estates this is a routine availability bug, but because the affected component is an OT/industrial safety-scanner driver, a crash could have operational-safety relevance in deployed automation environments. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to a host running the SICK Safetyscanners Base C++ driver sends a specially crafted packet whose declared length is not properly validated. The driver performs an out-of-bounds memory read while parsing it and crashes, producing a denial-of-service against the scanner-communication application. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
An out-of-bounds memory read in the SICK Safetyscanners Base C++ driver (CVE-2026-101290) lets a remote attacker crash the affected application by sending a specially crafted packet whose declared length is not properly validated during parsing. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it is reachable over the network without authentication or user interaction, but the impact is strictly availability - the driver reads past the end of a buffer and the process terminates, producing a denial-of-service condition with no confidentiality or integrity effect and no code execution. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; real-world exposure is bounded by network reachability, since an attacker must be able to deliver malformed scanner-protocol traffic to the interface or port the driver parses, which in typical OT deployments requires presence on or routing into the industrial/scanner network segment. SICK AG published advisory SCA-2026-0015 covering the affected driver.
RemediationAI
No vendor-released patch has been identified at time of analysis, so the immediate action is to consult SICK advisory SCA-2026-0015 (https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0015.json and https://www.sick.com/.well-known/csaf/white/2026/sca-2026-0015.pdf) or the SICK PSIRT page at https://www.sick.com/psirt to confirm whether a fixed driver version has since been published, and to apply it under the vendor's normal change-control process if so. Because the flaw is only reachable by delivering malformed packets to the interface where the driver parses scanner-protocol traffic, the most effective compensating controls are network-level: place the driver host and safety scanners on a dedicated OT segment and block inbound traffic to the parser port from untrusted zones and from IT/corporate networks, accepting that this constrains legitimate remote diagnostics and may require jump hosts for maintenance. Where scanning traffic must cross segments, enforce allowlists so only known scanner IP addresses and expected protocol ports can reach the driver, and use a firewall or industrial DMZ to prevent lateral movement from an already-compromised host - the trade-off is added configuration complexity and the need to update rules when scanner inventory changes. General OT hardening guidance in CISA's ICS recommended practices (https://www.cisa.gov/resources-tools/resources/ics-recommended-practices) supports this segmentation approach, and because the only realized impact is a crash, operators should also enable process-level restart/watchdog behavior for the affected application with alerting on unexpected terminations so that a successful DoS is detected rather than silently degrading monitoring availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds read (CWE-125) in the SICK Safetyscanners Base C++ driver, a software component used to communicate with SICK safety scanner devices over the network. When the driver parses an incoming packet, it fails to sufficiently validate the packet length field before using it to index into the receive buffer, so an attacker-controlled length can cause reads beyond the allocated memory region. Because the malformed input is delivered as network traffic and the parsing path requires no credentials or user interaction (PR:N/UI:N in the assessed vector), the fault is triggered purely by reaching the listening/processing endpoint. The CPE string cpe:2.3:a:sick_ag:sick_safetyscanners_base_cpp_driver:*:*:*:*:*:*:*:* uses a wildcard version, indicating that all released versions of the driver are considered affected as published in SICK advisory SCA-2026-0015. Vendor and upstream tags classify the issue alongside buffer-overflow and information-disclosure categories; while an out-of-bounds read can in principle leak adjacent memory contents, the independently assessed CVSS vector explicitly scores confidentiality and integrity as None (C:N/I:N), so the confirmed and scored outcome is memory-safety violation leading to an application crash and denial of service, not data exfiltration. Reference material from the vendor (SICK PSIRT, the SICK cybersecurity operating guidelines) and CISA's ICS recommended practices provide the surrounding guidance for protecting the OT segment in which this driver typically operates.
Know when Sick Safetyscanners Base Cpp Driver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated packet triggers the flaw (AV:N/AC:L/PR:N/UI:N); CWE-125 OOB read yields only a crash, so C:N/I:N and A:H with unchanged scope.
Primary rating from Vendor (SICK AG).
CVSS VectorVendor: SICK AG
DescriptionCVE.org
A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition.
Executive ViewAI
A high-severity vulnerability in the SICK Safetyscanners Base C++ driver can let an unauthenticated remote attacker crash applications that rely on scanner data, creating an availability risk for organizations using these SICK safety scanner integrations in OT environments. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so leadership should prioritize exposure reduction and continuity planning because the main business concern is operational downtime, not data compromise or code execution.
Network segmentation and firewall/ACL allowlists restricting scanner-protocol traffic to trusted OT hosts; protocol-aware filtering or IDS/IPS signatures to drop malformed length fields; application crash monitoring with rapid restart or failover procedures; removal of unnecessary routes into the industrial/scanner network; and engagement with SICK support for interim mitigation guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB