CVE-2026-16013

MediumCVSS 5.3

Published: 17/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Summary

A vulnerability has been found in the CIPster library of liftoff-sr, involving an out-of-bounds read in the CipAppPath::deserialize_symbolic function within cipepath.cc. The attack can be launched remotely, and exploit details have been publicly disclosed.

Risk Assessment

The organization is at risk of confidential data leakage or system destabilization due to remote exploitation of the out-of-bounds read vulnerability.

Recommendation

Apply the patch identified by commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519 immediately to remediate the issue.

Other vulnerabilities in CIPster

CVE-2026-13592High
A vulnerability was found in the EtherNet IP Message Handler component of the CIPster library (up to commit e8e9dba09bf56962807d3504b783ccdb6287f3e4), involving an out-of-bounds write in the BufWriter::append function. Remote exploitation is possible and the exploit has been made public.

Original NVD description (English source)

A vulnerability has been found in liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760. Affected by this issue is the function CipAppPath::deserialize_symbolic of the file source/src/cip/cipepath.cc. Such manipulation leads to out-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The name of the patch is 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519. A patch should be applied to remediate this issue.