Issues

Remote `stack-buffer-overflow read` in Connection Manager services after long padded EPath leaves zero request body

#577

· CarnegieMe opened

on May 28, 2026

Valid GetAttributeList request causes response-side `buffer overflow` via per-entry size underestimation

#576

· CarnegieMe opened

on May 28, 2026

Cross-protocol stale CPF `data_item` reuse causes `stack-use-after-return` in TCP SendUnitData path

#575

· CarnegieMe opened

on May 28, 2026

ForwardOpen: 32-bit logical class/instance/connection-point segments desynchronize `remaining_path` and trigger a reachable stack-buffer-overflow read in `ParseConnectionPath()`

#574

· CarnegieMe opened

on May 28, 2026

ASan `stack-buffer-overflow` in real TCP `SendRRData` path when a recognized truncated optional sockaddr CPF item is parsed in `CreateCommonPacketFormatStructure()`

#573

· CarnegieMe opened

on May 28, 2026

`SetAttributeList` performs an out-of-bounds read on a non-settable `kCipShortString` attribute in the default build via real TCP `SendRRData`

#572

· CarnegieMe opened

on May 27, 2026

Remote stack-based out-of-bounds read in `ForwardOpen` connection path parsing due to incorrect Production Inhibit Time path-length accounting

#571

· CarnegieMe opened

on May 27, 2026

ForwardOpen `ParseConnectionPath()` does not bound Simple Data segment length against `remaining_path`, causing `remaining_path` underflow and an out-of-bounds read in `GetPathSegmentType()`

#570

· CarnegieMe opened

on May 27, 2026

Remote stack-buffer-overflow read in default `SendRRData` / `SetAttributeSingle` path via overlong but decodable Padded EPath reaching real attribute decoders

#569

· CarnegieMe opened

on May 27, 2026

Integer Underflow Leading to Stack Buffer Overflow in CIP Connected Message Path

#568

· MrAlaskan opened

on May 13, 2026

Malformed CPF and Get_Attribute_List request leads to pointer corruption and `denial of service` in OpENer

#567

· gff-cw opened

on Apr 27, 2026

ASan `stack-use-after-return` in TCP SendRRData path via CPF payload pointer lifetime bug

#566

· gff-cw opened

on Apr 26, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remote `stack-buffer-overflow read` in Connection Manager services after long padded EPath leaves zero request body

Valid GetAttributeList request causes response-side `buffer overflow` via per-entry size underestimation

Cross-protocol stale CPF `data_item` reuse causes `stack-use-after-return` in TCP SendUnitData path

ForwardOpen: 32-bit logical class/instance/connection-point segments desynchronize `remaining_path` and trigger a reachable stack-buffer-overflow read in `ParseConnectionPath()`

ASan `stack-buffer-overflow` in real TCP `SendRRData` path when a recognized truncated optional sockaddr CPF item is parsed in `CreateCommonPacketFormatStructure()`

`SetAttributeList` performs an out-of-bounds read on a non-settable `kCipShortString` attribute in the default build via real TCP `SendRRData`

Remote stack-based out-of-bounds read in `ForwardOpen` connection path parsing due to incorrect Production Inhibit Time path-length accounting

ForwardOpen `ParseConnectionPath()` does not bound Simple Data segment length against `remaining_path`, causing `remaining_path` underflow and an out-of-bounds read in `GetPathSegmentType()`

Remote stack-buffer-overflow read in default `SendRRData` / `SetAttributeSingle` path via overlong but decodable Padded EPath reaching real attribute decoders

Integer Underflow Leading to Stack Buffer Overflow in CIP Connected Message Path

Malformed CPF and Get_Attribute_List request leads to pointer corruption and `denial of service` in OpENer

ASan `stack-use-after-return` in TCP SendRRData path via CPF payload pointer lifetime bug

Search results