A malicious device can supply more configuration blocks than the fixed-size array in SOEM accommodates, causing a write past the array boundary. This overflow corrupts adjacent memory structures, potentially leading to program crashes, loss of functionality, or, if attacker control is achieved, arbitrary code execution. The vulnerability directly compromises memory integrity, elevating the risk to the system’s stability and reliability.

RT‑Labs AB's SOEM product, versions 2.0.0 and earlier, is vulnerable. All deployments using these releases without the subsequent patch are at risk.

The CVSS score of 6.5 classifies the flaw as moderate severity, and the lack of an EPSS entry suggests limited exploitation evidence to date. It is not listed in the CISA KEV catalog. The attack requires a device capable of sending configuration data to the affected system, likely through the standard SOEM configuration interface. While the vulnerability does not guarantee remote code execution, the potential for memory corruption and subsequent exploitation makes it a noteworthy threat that should be addressed without delay.