Junglewise Threat Intelligence

CVE-2026-16013: liftoff-sr CIPster out-of-bounds read in CipAppPath::deserialize_symbolic

CVE-2026-16013 · Severity: medium · CVSS 5.3 · Published 2026-07-17

Technologies: Liftoff Systems CIPster. Vendors: Liftoff Systems.

Executive brief

A vulnerability exists in CIPster, an open-source software stack used for industrial communication (EtherNet/IP). A remote attacker can send a specially crafted network message that causes the software to read beyond its intended memory boundaries. This can lead to a service crash, resulting in a denial-of-service condition for industrial equipment or applications relying on this communication stack.

Technical details

An out-of-bounds read vulnerability exists in liftoff-sr CIPster up to commit 632336d. The flaw is located in the CipAppPath::deserialize_symbolic function within source/src/cip/cipepath.cc. The parser trusts the length field of a symbolic segment without verifying that the remaining buffer size is sufficient before performing a memcpy operation. A remote, unauthenticated attacker can exploit this by sending a crafted SendRRData packet containing a truncated symbolic segment. This results in a read beyond the global TCP receive buffer (s_buf), leading to a denial-of-service (crash). A patch has been released in commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519.

Affected products

  • liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760

Timeline

  • 2026-07-17: advisory: NVD publication date
  • 2026-07-17: disclosed: Public disclosure of the vulnerability and exploit details
  • 2026-07-17: patched: Patch commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519 identified

References

Related threats