Description

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T10:16:40.197Z",
  "pubdate": "2026-08-27T10:16:40.197Z",
  "executiveSummary": "CodeMeter Runtime contains a critical vulnerability stemming from improper input validation during request processing. When configured as a server, the application fails to perform necessary bounds checks on the data length field within requests utilizing opcode 0x5e.\nThis flaw allows an unauthenticated, remote attacker to trigger an out-of-bounds read by supplying a malicious length value that does not correspond to the actual payload size. The immediate impact of this vulnerability is a segmentation fault, resulting in a denial-of-service (DoS) condition that crashes the CodeMeter Runtime service.\nThe vulnerability affects CodeMeter Runtime versions prior to 8.41a and 9.10. Given the role of CodeMeter as a license management and protection framework, a crash can lead to operational disruption for any dependent software relying on valid license verification. The exploit does not require prior authentication, making it a significant concern for internet-facing systems or exposed network segments where the CodeMeter service is reachable.",
  "technicalDetails": "The vulnerability is situated within the request handling logic of the CodeMeter Runtime when operating in server mode. Specifically, the flaw resides in the parsing routine responsible for processing requests containing the opcode 0x5e.\nRoot Cause Analysis: The internal handler for opcode 0x5e expects a request structure consisting of a defined data length parameter followed by the associated binary data. The implementation fails to validate the provided length value against the actual memory boundaries allocated for the request buffer. When a crafted request provides an erroneously large length value, the application proceeds to process memory beyond the legitimate buffer limit. This access to arbitrary memory addresses results in an out-of-bounds read operation.\nAttack Flow and Exploitation: An attacker initiates the exploitation sequence by transmitting a specially crafted packet over the network to the port where CodeMeter Runtime is listening. The malicious packet specifies a length value that exceeds the expected input buffer size. As the service attempts to read data according to the specified length parameter, it traverses memory outside of its protected buffer. This memory access violation triggers a segmentation fault (SIGSEGV). Because the CodeMeter process does not appropriately handle this exception, the runtime service terminates unexpectedly, causing a total service outage.\nExposure and Requirements: The vulnerability is remotely exploitable, as it requires no interaction from a local user or pre-existing authentication credentials. The requirement for exploitation is simply the ability to reach the CodeMeter Runtime server interface via the network. While the primary identified outcome is a denial-of-service, the lack of bounds checking represents a fundamental memory corruption flaw.\nAffected Versions: All versions of CodeMeter Runtime released prior to 8.41a and 9.10 are considered susceptible. The issue is restricted to configurations where the runtime acts as a server, exposing the listener to network-based input processing."
}