← Vulnerability feed

Vulnerability record · CVE-2026-51536 · published 13 July 2026

CVE-2026-51536: Opener project opener integer overflow vulnerability

Opener Project · Opener

In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length parameter can overflow or be truncated into a negative value. This negative length bypasses subsequent bounds checking (due to signed/unsigned comparison issues) and is ultimately used in memory operations, leading to a Stack Buffer Overflow when reading data in DecodePaddedEPath.

9.1 CVSS 3.1 Critical EPSS 0.63% · top 52.0% CWE-190 · Integer overflow
9.1CVSS 3.1 base score
0.63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
11 Aug 2026Last modified by NVD

Description

In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length parameter can overflow or be truncated into a negative value. This negative length bypasses subsequent bounds checking (due to signed/unsigned comparison issues) and is ultimately used in memory operations, leading to a Stack Buffer Overflow when reading data in DecodePaddedEPath.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://gist.github.com/MrAlaskan/e160c626a32e03e5d9eddaa732560672 Third Party Advisory
https://github.com/EIPStackGroup/OpENer/issues/563 ExploitIssue TrackingVendor Advisory
https://github.com/EIPStackGroup/OpENer/issues/563 ExploitIssue TrackingVendor Advisory

Track CVE-2026-51536 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2021-21777Opener project opener out-of-bounds read vulnerabilityAn information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development commit 8c73…EPSS 1.7%9.8CVE-2026-51540Opener project opener vulnerabilityOpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing …EPSS 0.57%9.8CVE-2022-43604Opener project opener out-of-bounds write vulnerabilityAn out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commi…EPSS 14%9.8CVE-2022-43605Opener project opener out-of-bounds write vulnerabilityAn out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commi…EPSS 14%9.8CVE-2020-13556Opener project opener out-of-bounds write vulnerabilityAn out-of-bounds write vulnerability exists in the Ethernet/IP server functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A s…EPSS 4.7%9.1CVE-2026-51537Opener project opener out-of-bounds read vulnerabilityEIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing sh…EPSS 0.65%9.1CVE-2026-51538Opener project opener improper access control vulnerabilityEIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When th…EPSS 0.52%9.1CVE-2026-51541Opener project opener out-of-bounds read vulnerabilityOpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath si…EPSS 0.55%

Source: NIST National Vulnerability Database (record CVE-2026-51536), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.