CVE-2026-27664 is an out-of-bounds write vulnerability (CWE-787) affecting Siemens CPCI85 Central Processing/Communication and SICORE Base system versions before V26.10. The vulnerability arises from improper handling of specially crafted XML inputs, allowing an unauthenticated attacker to send malicious XML requests that trigger memory corruption. This results in a denial-of-service condition by crashing the affected service. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation leads to denial-of-service by crashing the affected Siemens CPCI85 Central Processing/Communication or SICORE Base system service. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected service from untrusted networks to reduce exposure to unauthenticated XML input attacks.