CVE-2026-16013: CIPster Buffer Overflow Vulnerability

CVE-2026-16013 Overview

CVE-2026-16013 is an out-of-bounds read vulnerability in the liftoff-sr CIPster library, an open-source implementation of the Common Industrial Protocol (CIP). The flaw resides in the CipAppPath::deserialize_symbolic function within source/src/cip/cipepath.cc. An attacker can trigger the condition remotely by sending a crafted CIP application path, causing the parser to read memory beyond an intended buffer. CIPster operates on a rolling release model, so no fixed version number applies; the fix is delivered through commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519. The issue is tracked under [CWE-119] and has been publicly disclosed with a proof-of-concept archive.

Critical Impact
A remote, unauthenticated attacker can send a malformed CIP symbolic path to trigger an out-of-bounds read, resulting in limited availability impact against industrial control endpoints running the vulnerable CIPster code.

Affected Products

liftoff-sr CIPster up to commit 632336d414ef708a542377c1aa8d6fdb7c70a760
CIP application path parser in source/src/cip/cipepath.cc
Downstream products embedding vulnerable CIPster source (rolling release; no discrete version numbers)

Discovery Timeline

2026-07-17 - CVE-2026-16013 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-16013

Vulnerability Analysis

CIPster parses EtherNet/IP application paths through the DeserializeAppPath routine, which delegates symbolic path handling to CipAppPath::deserialize_symbolic. The function reads a byte_count value from the incoming buffer and then copies that many bytes into a fixed-size tag array. The pre-patch code invokes memcpy(tag, in.data(), byte_count) without verifying that byte_count bytes are actually present in the underlying BufReader. When the attacker-controlled length exceeds the remaining bytes in the input buffer, the copy proceeds to read past the end of the source buffer, producing an out-of-bounds read tracked as [CWE-119].

The patch replaces the direct memcpy with in.get_bytes((uint8_t*) tag, byte_count), which delegates to BufReader and raises std::range_error when the buffer would be over-read. The documentation in cipepath.h was also updated from "buffer overrun" to "buffer over-read" to reflect the corrected semantic.

Root Cause

The root cause is missing bounds validation on the source buffer during symbolic path deserialization. Only the destination bound (sizeof(tag)-1) was checked; the BufReader remaining-length invariant was not enforced before the memcpy. As a result, an attacker who supplies a byte_count smaller than sizeof(tag) but larger than the remaining input length bypasses the existing guard.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted CIP message containing an AnsiExtendedSymbol segment with a byte_count that exceeds the actual message payload. The vulnerable parser reads adjacent memory into the tag buffer, which may cause a crash or leak process memory contents into subsequent responses depending on how the caller uses the tag.

text

         if( byte_count > (int) sizeof(tag)-1 )
             throw std::runtime_error( "CipAppPath has too big AnsiExtendedSymbol" );
 
-        memcpy( tag, in.data(), byte_count );
+        in.get_bytes( (uint8_t*) tag, byte_count );
         tag[byte_count] = 0;
-        in += byte_count;
 
         // Vol1 C-1.4.5.2 does not say that the pad byte is conditional
         // on CTL_PACKED_EPATH, but the spec could be deficient there.

Source: GitHub Commit 886a4d0

Detection Methods for CVE-2026-16013

Indicators of Compromise

Unexpected process crashes or std::range_error exceptions in applications embedding CIPster after receiving EtherNet/IP traffic.
Inbound CIP messages on TCP/UDP port 44818 containing AnsiExtendedSymbol segments whose declared length exceeds the remaining packet payload.
Presence of the public proof-of-concept archive referenced in the POC Archive Download on operator or engineering workstations.

Detection Strategies

Inspect the CIPster source tree for the vulnerable memcpy( tag, in.data(), byte_count ) pattern in source/src/cip/cipepath.cc and confirm the presence of patch commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519.
Deploy network signatures on OT segments that parse CIP EPATH structures and flag AnsiExtendedSymbol segments whose length field is inconsistent with the CIP message size.
Correlate ICS asset inventories against software bills of materials (SBOMs) to enumerate devices linking against the CIPster stack.

Monitoring Recommendations

Enable verbose logging on CIP-capable devices and forward events to a centralized analytics platform to spot repeated malformed-path parse failures.
Monitor EtherNet/IP traffic between engineering workstations, PLCs, and any embedded devices for anomalous session terminations following symbolic segment traffic.
Track upstream commits on the CIPster GitHub Project and the associated GitHub Issue #53 for follow-on hardening changes.

How to Mitigate CVE-2026-16013

Immediate Actions Required

Update all embedded copies of CIPster to include commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519 and rebuild dependent firmware or applications.
Restrict network reachability of CIP endpoints (typically TCP/UDP 44818 and UDP 2222) to trusted engineering hosts using firewall rules or ACLs.
Audit any product integrating CIPster and coordinate with the vendor if binary firmware updates are required.

Patch Information

The upstream fix is commit 886a4d090e1c5b0475f0b1c2fe0606a8f0d6a519, which replaces the unchecked memcpy with BufReader::get_bytes. This enforces source-buffer bounds and raises std::range_error on over-read attempts. Because CIPster is a rolling release without version tags, downstream consumers must pin their build to a commit at or after this hash. Full patch details are available in the GitHub Commit Update and the VulDB CVE-2026-16013 entry.

Workarounds

Place vulnerable devices behind an ICS-aware firewall or data diode that validates CIP message length fields before forwarding.
Disable or block symbolic segment processing at network chokepoints if it is not required by the application.
Segment OT networks so that only authenticated engineering hosts can initiate CIP sessions to affected endpoints.

bash

# Example iptables rule limiting EtherNet/IP to a trusted engineering host
iptables -A INPUT -p tcp --dport 44818 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 44818 -j DROP
iptables -A INPUT -p udp --dport 2222 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p udp --dport 2222 -j DROP