rt-labs SOEM EUVD-2026-109678

Exploitation requires a malicious or compromised EtherCAT slave device on the fieldbus that, during the master's device-configuration phase, presents more than EC_MAXFMMU configuration (FMMU) blocks; SOEM then writes these into a fixed-size array without validating the index against EC_MAXFMMU, forcing out-of-bounds writes. The key limiting factor is access: per the CVSS AV:A, the attacker must be adjacent on the EtherCAT network and able to introduce or control a device, so segmented or physically controlled fieldbus deployments substantially reduce exposure. No authentication or user interaction is required once such a device is present (PR:N/UI:N), and the impact is confined to availability (C:N/I:N/A:H) - memory corruption disrupting master operation rather than confirmed code execution.

This is a moderate-severity, availability-only issue that should be prioritized by operators of SOEM-based EtherCAT masters but does not warrant emergency response. The provided CVSS:3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates an adjacent-network attack by an unauthenticated actor with low complexity, impacting availability only - consistent with an out-of-bounds write (CWE-787) that corrupts adjacent memory and disrupts operation rather than yielding code execution or data disclosure. No EPSS score, CISA KEV listing, or PoC/exploit reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this tempers the raw severity. The vuln.today Decision label is 'this_month' (not act_now/emergency), aligning with a real but non-urgent priority. One important nuance: the attacker here is modeled as a malicious EtherCAT device presenting more than EC_MAXFMMU configuration blocks, so 'adjacent' realistically means an attacker able to introduce or compromise a device on the EtherCAT fieldbus - a meaningful limiting factor in segmented industrial networks. No conflicting signals were found, but EPSS, KEV, and PoC data are simply absent rather than contradictory.

An attacker who can place or compromise a device on the EtherCAT network presents a slave device that advertises more than EC_MAXFMMU configuration blocks during device configuration. SOEM writes each block into a fixed-size array without bounds-checking the index, so the excess writes spill past the array boundary and corrupt adjacent memory, disrupting subsequent master operations. No public exploit identified at time of analysis; exploitation requires adjacent (fieldbus) access rather than remote network reach.