CVE-2026-82357CWE-476

CVE-2026-82357

Medium · published October 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00287 · 20.2th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-10-02T00:17Z
References (4)
https://github.com/rtlabs-com/c-open/releases/tag/public%2Fv1.1.1 · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json · 9119a7d8-5eab-497f-8521-727c672e3725https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-82357 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 03 OCT 03:46Z
    EPSS moved — → 0%
    epss
  • 01 OCT 19:41Z
    RT-Labs AB C-Open CANopen NULL pointer dereference
    cvelistv5