What is CVE-2026-89208?

CVE-2026-89208 is a medium-severity vulnerability in Siemens Capital Embedded Ar Classic 431-422, classified under Out-of-bounds Read. CVSS score: 5.3/10. Published 2026-10-13.

How severe is CVE-2026-89208?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Out-of-bounds Read in Siemens Capital Embedded Ar Classic 431-422

CVE-2026-89208

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

Vulnerability class: Buffer Overflow

Published 2026-10-13 · last modified 2026-10-13.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

Frequently asked questions

What is CVE-2026-89208?: CVE-2026-89208 is a medium-severity vulnerability in Siemens Capital Embedded Ar Classic 431-422, classified under Out-of-bounds Read. CVSS score: 5.3/10. Published 2026-10-13.
How severe is CVE-2026-89208?: Medium severity. CVSS v3 base score is 5.3 out of 10.