---
id: CVE-2026-82946
title: Null Pointer Dereference in Mailbox Error Handling
summary: >-
  SOEM version 2.0.0 and earlier contains a vulnerability where a malicious
  device can crash the master system. When the software receives an error
  response, it clears an internal pointer but continues processing. If another
  message arrive…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-476
  - CWE-690
vendor: RT-Labs AB
product: SOEM
affected:
  - SOEM < 2.0.1
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T08:55:20.654Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-82946'
references:
  - url: 'https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf'
tags:
  - cve.org
ingestedAt: '2026-10-26T09:22:35.520Z'
---

## Overview

SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.

## Affected

- `SOEM < 2.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.