The vulnerability is a buffer overflow triggered during multi‑segment SDO uploads in the SOEM implementation. The software validates the total size only once when the transfer begins, ignoring the running total of segment sizes thereafter. A malicious device can therefore send an initial segment that satisfies the size check and then transmit additional segments that cumulatively exceed the allocated buffer. Writing data beyond the buffer's boundaries can corrupt memory and potentially allow an attacker to inject and execute arbitrary code. The weakness is rooted in improper bounds checking and is classified as a classic buffer overflow (CWE‑120).

The flaw exists in RT‑Labs AB's SOEM library, affecting all versions 2.0.0 and older. Systems that embed SOEM—such as industrial automation controllers, EtherCAT masters, or devices using the library for serial over Ethernet communications—are at risk if they accept data from untrusted or remote devices.

The CVSS score of 8.8 indicates a high severity, with a high likelihood of successful exploitation once an attacker can communicate with the vulnerable device and initiate a multi‑segment SDO upload. The EPSS score is not available, but the absence of a KEV listing suggests that no widespread exploits have been reported to date. Nevertheless, the ability to trigger arbitrary memory writes makes the vulnerability highly attractive for attackers seeking to compromise control devices or embedded systems. Lacking a public exploit means the actual risk depends on the attacker's ability to reach the target device over the network or physical connection.