EUVD-2026-66982
GHSA-ccvp-8vxx-4m3m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed CodeMeter server port
-
DeliveryEstablish TCP connection to port 22350
-
ExploitSend opcode 0x5e request with oversized length field
-
ExecutionServer reads beyond buffer boundary
-
PersistSegmentation fault crashes CodeMeter Runtime
-
ImpactLicensed application access denied
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Length parameter validation
|
| Exploitation Conditions | The target must be running CodeMeter Runtime explicitly configured in server mode - deployments where CodeMeter operates as a client only are not affected. The server's listening port must be reachable from the attacker's network position. No authentication is required per CVSS PR:N, and no user interaction is needed. Exploitation is bounded to denial of service; no code execution, privilege escalation, or data disclosure is achievable based on the out-of-bounds read primitive and confirmed impact metrics (C:N/I:N). The vulnerability affects versions before 8.41a and before 9.10 - fully patched systems are not vulnerable. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly characterizes this as a remotely triggerable, unauthenticated crash with no authentication barrier and minimal exploitation complexity - a single malformed packet is sufficient. However, the impact is strictly availability: confidentiality and integrity are not affected, limiting the business consequence to service disruption rather than data breach or system compromise. The critical limiting factor is the server-mode deployment requirement; environments running CodeMeter only as a client are entirely unaffected. For software publishers and enterprises whose production workflows depend on CodeMeter license enforcement, a remotely induced crash represents meaningful operational risk despite the narrow impact class. No EPSS data was provided, no KEV listing exists, and no POC is referenced in the vendor advisory, reducing immediate exploitation urgency. This is a legitimate patching priority for server-mode deployments, not a theoretical high-CVSS paper risk. |
| Exploit ScenarioDerived | An unauthenticated remote attacker establishes a TCP connection to a CodeMeter Runtime server and sends a crafted request specifying opcode 0x5e with an oversized or otherwise malformed data length value. The server reads beyond the legitimate buffer boundary, triggering a segmentation fault that immediately terminates the CodeMeter Runtime process. Any application on the host relying on CodeMeter for license validation subsequently fails to operate until the service is manually restarted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed data length field, allowing remote unauthenticated attackers to trigger an out-of-bounds read and segmentation fault. Wibu-Systems versions before 8.41a and 9.10 are confirmed affected. The impact is a full service crash, denying access to any software whose licensing depends on the CodeMeter Runtime server - no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Upgrade CodeMeter Runtime to version 8.41a or 9.10 (or later), per the Wibu-Systems advisory at https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf. If immediate patching is not feasible, restrict inbound network access to the CodeMeter Runtime server port (typically TCP 22350) via host-based or perimeter firewall rules, limiting connections to explicitly trusted IP addresses only; this reduces the attack surface to compromised or malicious trusted hosts but does not eliminate the vulnerability. Note that overly restrictive firewall rules may interrupt legitimate license check traffic from authorized clients, so test scope carefully before deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CodeMeter Runtime (CPE: cpe:2.3:a:wibu-systems-ag:codemeter-runtime) is a software licensing and digital rights management runtime by Wibu-Systems AG that, when deployed in server mode, listens for license-related requests over the network (typically TCP 22350). The vulnerability is rooted in CWE-130 (Improper Handling of Length Parameter Inconsistency): requests carrying opcode 0x5e include a client-supplied data length field followed by the data payload. The server consumes the length value to determine how much data to read but performs no bounds validation against the actual buffer size, causing an out-of-bounds read. The corrupted memory state produces a segmentation fault that terminates the CodeMeter Runtime process entirely.
Know when Codemeter Runtime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable server crashes on a single malformed packet with no authentication; impact is purely availability, no confidentiality or integrity exposure.
Primary rating from Vendor (wibu).
CVSS VectorVendor: wibu
Lifecycle Timeline
2DescriptionCVE.org
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.
Executive ViewAI
CodeMeter Runtime versions before 8.41a and 9.10 are vulnerable to remote denial-of-service attacks that crash the licensing service without requiring authentication, blocking access to any software applications dependent on CodeMeter for license verification. Organizations using CodeMeter-licensed products face immediate operational disruption risk if attackers exploit this remotely accessible vulnerability.
Implement firewall and network segmentation restricting CodeMeter Runtime server access to authorized internal systems only, eliminating external network-based attack surface. Disable server mode if not required for operations. Deploy network monitoring and alerting for suspicious requests targeting CodeMeter service ports. Maintain incident response procedures for rapid service recovery and failover to alternative licensing validation methods if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Codemeter Runtime
View allA heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthentic
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes a
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode
Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file withou
Exploit-DB