CVE-2026-75347 Details

An expired pointer dereference vulnerability has been identified in EIPStackGroup OpENer versions 2.3 and master up to commit 76b95cf. The vulnerability arises in the EtherNet/IP Common Packet Format (CPF) handling logic, where the parsing state is globally shared across different messages and transport paths. This flaw allows a remote attacker to cause a denial-of-service by sending a crafted sequence of TCP and UDP packets that exploit the stale pointer, leading to a stack-use-after-return condition.

To address this vulnerability, the CPF parsing logic should be modified to use local state instead of a global object, ensuring that each packet is processed independently. Additionally, the 'CreateCommonPacketFormatStructure' function should be updated to fully initialize the CPF data items before parsing, and the connected CPF handling should include validation checks to prevent the reuse of stale data.