SOEM EUVD-2026-109659

Exploitation requires an attacker-controlled or compromised device on the same EtherCAT network segment as the SOEM master (reflected by CVSS AV:A), which then sends crafted messages containing manipulated length values that drive negative or oversized results through unvalidated length arithmetic, bypassing safety checks. The condition is not a toggleable feature - it applies to masters built on SOEM 2.0.0 and earlier that process messages from network devices, i.e. normal operation. The primary limiting factor is the adjacency requirement: the attacker must already have access to the fieldbus (physical or logical presence as/behind a slave device), so internet-facing remote exploitation is not indicated. No authentication is required (PR:N) and no user interaction is needed (UI:N).

This is a genuine priority for organizations running EtherCAT automation, though not a drop-everything emergency, consistent with the vuln.today 'this_week' decision label. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, base 8.3) shows the most important limiting factor: the attack vector is Adjacent (AV:A), not Network - an attacker needs a presence on the EtherCAT fieldbus segment (a malicious or compromised slave device) rather than arbitrary internet reach. Given that, complexity is low, no privileges and no user interaction are required, and the impact is high integrity and availability with memory corruption that may lead to arbitrary code execution on the master. No EPSS score was supplied, the CVE is NOT in CISA KEV, and the only reference is the vendor advisory PDF (not exploit code), so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore internally consistent: high technical impact gated behind adjacent-network access, with no confirmed exploitation yet - treat it as a near-term patching priority for exposed EtherCAT deployments rather than a widely-wormable internet threat.

An attacker who has compromised or introduced a malicious slave device onto the EtherCAT network sends specially crafted messages with manipulated length fields to the SOEM-based master. Because the master performs arithmetic on these length values without validating against negative or extremely large values, it writes beyond allocated memory boundaries, corrupting memory and potentially achieving arbitrary code execution on the master controller. No public exploit code was identified at time of analysis; the trigger mechanism is described only at a high level in the vendor advisory.