Siemens Desigo/Capital AR Classic Input Bounds OOB Read (CVE-2026-89208)
CVE-2026-89208 Published on October 13, 2026
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.
Weakness Type
Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. A crash can occur when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string. The expected sentinel might not be located in the out-of-bounds memory, causing excessive data to be read, leading to a segmentation fault or a buffer overflow. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent read operation then produces undefined or unexpected results.
Affected Versions
Siemens Capital Embedded AR Classic 431-422:- Before * is affected.
- Before V2303 is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.
- Version V2.3 and below * is affected.