What is the CVSS score of CVE-2026-38719?

CVE-2026-38719 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

OpENer CVE-2026-38719

EUVD-2026-30780 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-18 mitre

GHSA-cr85-g5v9-2m32

Buffer Overflow Information Disclosure N A

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

8.2 HIGH

ENIP is a network protocol so AV:N; OOB read may expose adjacent memory (C:L) despite official C:N; no auth or interaction required.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:07 vuln.today

CVE Published

May 18, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specifically in CreateCommonPacketFormatStructure() in source/src/enet_encap/cpf.c. A crafted ENIP/CPF message can supply an attacker-controlled item_count value that is not consistently validated against the remaining data_length of the CPF slice

AnalysisAI

Out-of-bounds read in OpENer v2.3-558-g1e99582 exposes EtherNet/IP stack implementations to denial-of-service via a crafted CPF message with an attacker-controlled item_count value that bypasses validation in CreateCommonPacketFormatStructure(). Affected deployments - typically industrial control system (ICS) devices running this open-source ENIP stack - can be crashed without authentication. A proof-of-concept is confirmed via SSVC but the vulnerability is not listed in CISA KEV. EPSS sits at 0.01% (2nd percentile), indicating low observed exploitation pressure.

Technical ContextAI

OpENer is an open-source EtherNet/IP (ENIP) protocol stack targeting embedded and industrial automation devices. ENIP uses the Common Packet Format (CPF) for encapsulating CIP (Common Industrial Protocol) items. The vulnerable function CreateCommonPacketFormatStructure() in source/src/enet_encap/cpf.c parses CPF messages by iterating over item_count entries. The root cause (CWE-125: Out-of-bounds Read) is inconsistent validation: item_count is not reliably checked against the actual remaining data_length of the CPF slice, allowing a crafted packet to cause the parser to read past the end of the allocated buffer. CPE data is listed as n/a in the source feed, so affected versions must be inferred from the GitHub commit reference (g1e99582) and issue #558. The tags include 'Buffer Overflow' alongside 'Information Disclosure', though CWE-125 is strictly an out-of-bounds read - the buffer overflow tag appears to be an inaccurate classification applied by the reporter.

RemediationAI

No vendor-released patched version has been independently confirmed at time of analysis. The upstream issue is tracked at https://github.com/EIPStackGroup/OpENer/issues/558 - operators should monitor this issue for a committed fix and apply it once a tagged release is available. In the interim, network-layer mitigations are the primary recourse: restrict access to ENIP TCP port 44818 and UDP port 2222 via firewall rules to permit only known, trusted engineering workstations and controllers. ICS-specific deep packet inspection (DPI) capable of validating CPF item_count against frame length can detect and drop malformed ENIP packets. Deploying the device behind an industrial DMZ with unidirectional data diodes or protocol-aware gateways reduces exposure. Note: blocking ENIP entirely will disrupt legitimate I/O and messaging operations - coordinate mitigation windows with operations teams.