Description
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format
specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory
and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and
remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this
vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime | 9.00 – < 9.10, 8.00 – < 8.41a, 7.00 | 9.10 |
Advisories 9
- VDE-2026-084 Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation in the PLCnext Firmware CERT@VDE · Nov 4, 2026
- VDE-2026-098 Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation for SW Tools CERT@VDE · Nov 4, 2026
- SCA-2026-0011 Vulnerabilities in Wibu Systems CodeMeter Runtime Affect Multiple SICK Products SICK PSIRT · Sep 30, 2026
- VDE-2026-091 TRUMPF: Multiple products affected by Wibu CodeMeter vulnerabilities CERT@VDE · Sep 15, 2026
- 3BHS973333 AC 800PEC, AC 800PEC ARM, AC 800PEC Tool, Control Terminal (xCT) and AC 800PEC Tool Cheetah Impacted by multiple vulnerabilities in Wibu CodeMeter ABB PSIRT · Sep 10, 2026
- 2NGA003144 ABB AbilityTM zenon Security Risk Due to High-Severity Vulnerabilities in WIBU CodeMeter Runtime ABB PSIRT · Sep 9, 2026
- 3ADR011572 Automation Builder, Drive Application Builder, Virtual Drive, Virtual DrivePlus Impacted by multiple vulnerabilities in Wibu CodeMeter ABB PSIRT · Sep 3, 2026
- NCSC-2026-0333 Kwetsbaarheden verholpen in CodeMeter Runtime van Wibu-Systems NCSC-NL (Netherlands) · Aug 28, 2026
- WID-SEC-2026-3004 Wibu-Systems CodeMeter Runtime: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2026