SOEM EUVD-2026-109676

Exploitation requires the attacker to control a malicious or compromised EtherCAT device on the same local fieldbus segment as a SOEM master running version 2.0.0 or earlier (AV:A - adjacent, not remote/internet). The specific trigger is a multi-segment (segmented) data transfer: the attacker declares a small initial total size to pass SOEM's one-time size validation, then sends further segments whose cumulative size exceeds the allocated buffer, because the software does not track cumulative size as segments arrive. No authentication is required (PR:N) and no user interaction (UI:N), consistent with EtherCAT's lack of device authentication. The primary LIMITING factor is the adjacent-network precondition: an attacker must already have logical/physical access to the EtherCAT bus and the ability to act as or subvert a slave device, which bounds exposure to the industrial network rather than external attackers.

This is a genuinely serious but access-constrained flaw. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes an out-of-bounds write (CWE-787) reachable by an unauthenticated attacker with low complexity, but only from the ADJACENT EtherCAT network segment (AV:A) - not across the internet. The signals are mostly consistent: high technical impact (C:H/I:H/A:H) matches a memory-corruption bug with claimed code-execution potential, and the adjacent vector matches an EtherCAT fieldbus flaw where the attacker must be a device on the bus. However, several decision signals are MISSING rather than conflicting: no EPSS score is provided, so real-world exploitation probability cannot be quantified; the CVE is NOT in CISA KEV; and no SSVC exploitation/automatable/technical-impact values are supplied beyond the vendor-reported CVSS. The vuln.today Decision label is 'this_week', which indicates prompt but non-emergency prioritization - consistent with high severity offset by the adjacent-network precondition and absence of confirmed exploitation. Net judgment: this is a real priority for operators of EtherCAT/SOEM-based industrial systems (patch this week), not a high-CVSS-but-low-real-risk desk item, but it is also not an internet-facing mass-exploitation threat - exposure is bounded by physical/logical access to the fieldbus.

An attacker who has compromised or introduced a malicious EtherCAT slave device onto the local fieldbus initiates a multi-segment (segmented) data transfer to a SOEM-based master, declaring a small initial size that passes the one-time validation check. The attacker then streams additional segments whose cumulative size exceeds the allocated buffer, writing attacker-controlled data past the buffer boundary and potentially achieving code execution on the master. No public exploit identified at time of analysis; the only reference is the rt-labs vendor advisory PDF.