# CVE-2026-16013: liftoff-sr CIPster out-of-bounds read in CipAppPath::deserialize_symbolic

Source: https://junglewise.ai/threats/cve-2026-16013-liftoff-sr-cipster-out-of-bounds-read-in-cipapppath-deserialize  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-16013 · Severity: medium · CVSS 5.3 · Published 2026-07-17

A vulnerability exists in CIPster, an open-source software stack used for industrial communication (EtherNet/IP). A remote attacker can send a specially crafted network message that causes the software to read beyond its intended memory boundaries. This can lead to a service crash, resulting in a denial-of-service condition for industrial equipment or applications relying on this communication stack.

Technologies: [Liftoff Systems CIPster](https://junglewise.ai/threats/technologies/cipster). Vendors: [Liftoff Systems](https://junglewise.ai/threats/vendors/liftoff-systems).

## Quick answers

**Is CVE-2026-16013 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16013 being exploited in the wild.

**How severe is CVE-2026-16013?** Medium severity, with a CVSS score of 5.3, published 17 July 2026.

**Which products and versions are affected?** Liftoff Systems CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760.

**Is there a fix for CVE-2026-16013?** A patch was published on 2026-07-17: Patch commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519 identified Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16013 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16013?** Check whether you run Liftoff Systems CIPster at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in liftoff-sr CIPster up to commit 632336d. The flaw is located in the CipAppPath::deserialize_symbolic function within source/src/cip/cipepath.cc. The parser trusts the length field of a symbolic segment without verifying that the remaining buffer size is sufficient before performing a memcpy operation. A remote, unauthenticated attacker can exploit this by sending a crafted SendRRData packet containing a truncated symbolic segment. This results in a read beyond the global TCP receive buffer (s_buf), leading to a denial-of-service (crash). A patch has been released in commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519.

## Affected products

- liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760

## Timeline

- 2026-07-17: advisory: NVD publication date
- 2026-07-17: disclosed: Public disclosure of the vulnerability and exploit details
- 2026-07-17: patched: Patch commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519 identified

## References

- [https://github.com/liftoff-sr/CIPster/](https://github.com/liftoff-sr/CIPster/)
- [https://github.com/liftoff-sr/CIPster/commit/886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519](https://github.com/liftoff-sr/CIPster/commit/886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519)
- [https://github.com/liftoff-sr/CIPster/issues/53](https://github.com/liftoff-sr/CIPster/issues/53)
- [https://github.com/user-attachments/files/28926450/POC.zip](https://github.com/user-attachments/files/28926450/POC.zip)
- [https://vuldb.com/cve/CVE-2026-16013](https://vuldb.com/cve/CVE-2026-16013)
- [https://vuldb.com/submit/856794](https://vuldb.com/submit/856794)
- [https://vuldb.com/vuln/379755](https://vuldb.com/vuln/379755)

## Related threats

- [liftoff-sr CIPster out-of-bounds write in EtherNet/IP Message Handler](https://junglewise.ai/threats/cve-2026-13592-liftoff-sr-cipster-out-of-bounds-write-in-ethernet-ip-message)