CVE-2026-51541 describes an out-of-bounds read vulnerability in OpENer version 2.3.0 (commit 76b95cf). The vulnerability is triggered by sending a valid ENIP SendRRData frame with a CIP payload whose path_size field is forged to indicate more path words than actually exist. The CIP parser does not properly validate the path_size against the actual payload length, resulting in reads beyond the end of the stack receive buffer during path segment decoding. This memory safety flaw could potentially be exploited to cause application crashes or other unintended behavior.

The vulnerability allows an attacker to cause out-of-bounds reads in the OpENer CIP message parser. This can lead to application instability or crashes. There is no information about code execution or data corruption impacts. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting or validating ENIP SendRRData frames from untrusted sources to prevent malformed CIP payloads with forged path_size fields.