CVE-2026-76988
Received Received - Intake

Out-of-Bounds Read in liftoff-sr CIPster

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulDB

Description
A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forward_open of the file cipconnectionmanager.cc of the component ForwardOpen Handler. Executing a manipulation of the argument product_code_ can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ea870a274bf68dfaa3f511f20e2fff6778fb7b74. A patch should be applied to remediate this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76988
EUVD
EUVD-2026-63346

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
liftoff-sr cipster *
liftoff-sr cipster From 1802525be27d33e19a9a83c163e331a1d13b1892 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read issue in the liftoff-sr CIPster library. It occurs in the CipConnMgrClass::forward_open function when the product_code_ argument is manipulated. The flaw allows remote attackers to trigger a crash by sending a specially crafted ForwardOpen request, leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for malformed ForwardOpen requests targeting the CipConnMgrClass::forward_open function. Inspect network traffic for EtherNet/IP packets with mixed-class application paths or non-Assembly endpoints. Use tools like Wireshark with CIPster-specific dissectors or custom scripts to analyze product_code_ field manipulation. Check server logs for crashes or out-of-bounds read errors in cipconnectionmanager.cc.

Impact Analysis

This vulnerability can cause remote unauthenticated denial of service by crashing the CIPster server. Attackers can exploit it via normal TCP explicit messaging or ForwardOpen server paths without needing authentication.

Compliance Impact

The vulnerability allows remote unauthenticated denial of service by crashing the server through an out-of-bounds read. This could disrupt critical operations in industrial environments, potentially violating compliance requirements for availability in standards like GDPR (data processing integrity) and HIPAA (system reliability for protected health information).

Mitigation Strategies

Apply the patch ea870a274bf68dfaa3f511f20e2fff6778fb7b74 immediately. Update CIPster to the patched version. Implement input validation for ForwardOpen requests to ensure endpoints are Assembly objects. Temporarily restrict network access to CIPster servers until patched. Monitor for exploit attempts using IDS/IPS rules targeting malformed EtherNet/IP packets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart