# CVE-2026-13592: liftoff-sr CIPster out-of-bounds write in EtherNet/IP Message Handler

Source: https://junglewise.ai/threats/cve-2026-13592-liftoff-sr-cipster-out-of-bounds-write-in-ethernet-ip-message  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-13592 · Severity: high · CVSS 7.3 · Published 2026-06-29

CIPster is an open-source software library used by industrial devices to communicate over EtherNet/IP networks. A security flaw allows a remote attacker to send specially crafted network messages that can crash the device or potentially allow unauthorized access to its memory. This could lead to service outages in industrial environments or the exposure of sensitive operational data.

Technologies: [Liftoff Systems CIPster](https://junglewise.ai/threats/technologies/cipster). Vendors: [Liftoff Systems](https://junglewise.ai/threats/vendors/liftoff-systems).

## Quick answers

**Is CVE-2026-13592 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13592 being exploited in the wild.

**How severe is CVE-2026-13592?** High severity, with a CVSS score of 7.3, published 29 June 2026.

**Which products and versions are affected?** Liftoff Systems CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4.

**Is there a fix for CVE-2026-13592?** A patch was published on 2026-06-01: Patch 3a0159ed43125dcd024a1965f0289cb186bae9ff applied to master branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13592 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13592?** Check whether you run Liftoff Systems CIPster at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the BufWriter::append function within the EtherNet/IP Message Handler of CIPster. The root cause is a type-confusion flaw where the library's generic attribute handlers (GetAttrData/SetAttrData) trust a raw storage address without validating that the underlying object layout matches the declared CIP data type. Specifically, if a ByteBuf object is aliased as a writable kCipUdint attribute, an attacker can use a SetAttributeSingle request to overwrite the internal 'start' pointer of the ByteBuf. Subsequent operations on the same buffer as a kCipByteArray will use the poisoned metadata, leading to out-of-bounds reads or writes via memcpy. A patch (3a0159e) has been released that introduces strongly-typed attribute inserters to prevent such aliasing at compile-time.

## Affected products

- liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4

## Timeline

- 2026-06-01: patched: Patch 3a0159ed43125dcd024a1965f0289cb186bae9ff applied to master branch.
- 2026-06-29: disclosed: Vulnerability published via VulDB and NVD.

## References

- [https://github.com/liftoff-sr/CIPster/](https://github.com/liftoff-sr/CIPster/)
- [https://github.com/liftoff-sr/CIPster/commit/3a0159ed43125dcd024a1965f0289cb186bae9ff](https://github.com/liftoff-sr/CIPster/commit/3a0159ed43125dcd024a1965f0289cb186bae9ff)
- [https://github.com/liftoff-sr/CIPster/issues/48](https://github.com/liftoff-sr/CIPster/issues/48)
- [https://github.com/liftoff-sr/CIPster/issues/48](https://github.com/liftoff-sr/CIPster/issues/48)
- [https://github.com/user-attachments/files/28452971/poc.zip](https://github.com/user-attachments/files/28452971/poc.zip)
- [https://vuldb.com/cve/CVE-2026-13592](https://vuldb.com/cve/CVE-2026-13592)
- [https://vuldb.com/submit/844566](https://vuldb.com/submit/844566)

## Related threats

- [liftoff-sr CIPster out-of-bounds read in CipAppPath::deserialize_symbolic](https://junglewise.ai/threats/cve-2026-16013-liftoff-sr-cipster-out-of-bounds-read-in-cipapppath-deserialize)