CVE-2026-81575: CodeMeter Runtime DOS Vulnerability

CVE-2026-81575 Overview

CVE-2026-81575 is an out-of-bounds read vulnerability in Wibu-Systems CodeMeter Runtime when configured as a server. The flaw stems from missing bounds checking on the data length value in requests using opcode 0x5e. A remote unauthenticated attacker can send a crafted request that causes the service to read beyond allocated memory, triggering a segmentation fault. The resulting crash terminates CodeMeter Runtime and disrupts license-dependent applications relying on it. Affected releases include CodeMeter Runtime versions prior to 8.41a and 9.10.

Critical Impact
Remote unauthenticated attackers can crash CodeMeter Runtime servers, disabling license validation for dependent industrial and enterprise software.

Affected Products

Wibu-Systems CodeMeter Runtime versions prior to 8.41a
Wibu-Systems CodeMeter Runtime versions prior to 9.10
Systems running CodeMeter Runtime in server configuration

Discovery Timeline

2026-08-27 - CVE-2026-81575 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-81575

Vulnerability Analysis

CodeMeter Runtime, when configured as a server, exposes a network-accessible service that processes protocol requests identified by opcodes. The handler for opcode 0x5e accepts a data length field followed by the corresponding data payload. The implementation fails to validate the data length against the actual buffer size before reading. This missing check falls under [CWE-130] Improper Handling of Length Parameter Inconsistency.

An attacker sending a request with a manipulated length value causes the process to read memory outside the intended buffer. The out-of-bounds read triggers a segmentation fault and terminates the CodeMeter Runtime process. Applications relying on CodeMeter for license enforcement stop functioning until the service is restarted.

Root Cause

The root cause is absent bounds checking on the length parameter supplied in opcode 0x5e requests. The parser trusts attacker-controlled length values instead of validating them against the received data buffer size. This design deficiency permits deterministic out-of-bounds reads.

Attack Vector

Exploitation requires network access to the CodeMeter Runtime listener on a system configured as a server. No authentication or user interaction is needed. The attacker crafts a single protocol message containing opcode 0x5e with a length field larger than the accompanying data. Sending the message repeatedly enables sustained denial of service against license-dependent software.

No verified public exploit code is available. Refer to the Wibu Security Advisory WIBU-103401 for vendor technical details.

Detection Methods for CVE-2026-81575

Indicators of Compromise

Unexpected termination or crash logs from the CodeMeter Runtime service (CodeMeter.exe on Windows, CodeMeter daemon on Linux)
Segmentation fault entries in system logs correlated with CodeMeter process exits
License validation failures across dependent applications following inbound network activity to CodeMeter listener ports

Detection Strategies

Monitor process lifecycle events for CodeMeter Runtime and alert on abnormal exits or restart loops
Inspect network traffic to the CodeMeter default port (22350/TCP) for malformed requests containing opcode 0x5e with inconsistent length fields
Correlate application-level license errors with concurrent CodeMeter service failures to identify targeted disruption

Monitoring Recommendations

Enable verbose logging in CodeMeter Runtime and forward logs to a centralized SIEM for anomaly analysis
Track inbound connections to CodeMeter server instances and flag sources outside the expected client population
Alert on repeated service restarts of CodeMeter Runtime within short time windows

How to Mitigate CVE-2026-81575

Immediate Actions Required

Upgrade CodeMeter Runtime to version 8.41a or 9.10 or later on all systems running in server configuration
Restrict network access to the CodeMeter listener port (22350/TCP) using host and network firewalls
Inventory all systems running CodeMeter Runtime and confirm whether they operate in server mode

Patch Information

Wibu-Systems addressed the vulnerability in CodeMeter Runtime versions 8.41a and 9.10. Administrators should download the fixed release from Wibu-Systems and deploy it across all affected hosts. Full remediation details are documented in the Wibu Security Advisory WIBU-103401.

Workarounds

Limit CodeMeter server exposure to trusted client subnets using firewall access control lists
Disable server mode on hosts that do not require network-facing license distribution
Deploy network segmentation to isolate CodeMeter servers from untrusted networks and internet-facing zones

bash

# Example: restrict CodeMeter port 22350/TCP to a trusted subnet on Linux
iptables -A INPUT -p tcp --dport 22350 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22350 -j DROP