Out-of-Bounds Memory Read in SICK Industrial Application
CVE-2026-101290

7.5HIGH

Key Information:

Vendor

Sick Ag

Status
Sick Safetyscanners Base Cpp Driver
Vendor
CVE Published:
15 October 2026

What is CVE-2026-101290?

A newly identified vulnerability allows remote attackers to exploit insufficient validation of packet length in SICK industrial applications. By sending specially crafted network packets, an attacker can trigger an out-of-bounds memory read condition, potentially leading to application crashes and a denial-of-service situation. Organizations utilizing affected SICK products should prioritize patching and adequate monitoring to prevent unauthorized access and service interruptions.

Affected Version(s)

Sick_Safetyscanners_Base CPP Driver 0 <= 1.0.4

References

https://www.sick.com/psirt
x_SICK PSIRT Security Advisories
https://www.sick.com/media/docs/9/19/719/special_informat...
x_SICK Operating Guidelines
https://www.cisa.gov/resources-tools/resources/ics-recomm...
x_ICS-CERT recommended practices on Industrial Security

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks to kta1kri for reporting this issue in a coordinated manner (URL: https://github.com/kta1kri).
.