Description
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and
the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a
segmentation fault that ultimately crashes the CodeMeter Runtime.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime | 9.00 – < 9.10, 8.00 – < 8.41a | 9.10 |
Advisories 9
- VDE-2026-084 Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation in the PLCnext Firmware CERT@VDE · Nov 4, 2026
- VDE-2026-098 Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation for SW Tools CERT@VDE · Nov 4, 2026
- SCA-2026-0011 Vulnerabilities in Wibu Systems CodeMeter Runtime Affect Multiple SICK Products SICK PSIRT · Sep 30, 2026
- VDE-2026-091 TRUMPF: Multiple products affected by Wibu CodeMeter vulnerabilities CERT@VDE · Sep 15, 2026
- 3BHS973333 AC 800PEC, AC 800PEC ARM, AC 800PEC Tool, Control Terminal (xCT) and AC 800PEC Tool Cheetah Impacted by multiple vulnerabilities in Wibu CodeMeter ABB PSIRT · Sep 10, 2026
- 2NGA003144 ABB AbilityTM zenon Security Risk Due to High-Severity Vulnerabilities in WIBU CodeMeter Runtime ABB PSIRT · Sep 9, 2026
- 3ADR011572 Automation Builder, Drive Application Builder, Virtual Drive, Virtual DrivePlus Impacted by multiple vulnerabilities in Wibu CodeMeter ABB PSIRT · Sep 3, 2026
- NCSC-2026-0333 Kwetsbaarheden verholpen in CodeMeter Runtime van Wibu-Systems NCSC-NL (Netherlands) · Aug 28, 2026
- WID-SEC-2026-3004 Wibu-Systems CodeMeter Runtime: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2026