Siemens PSS(R)SINCAL Out-of-Bounds Write Vulnerability Affects Critical Infrastructure

Siemens PSS(R)SINCAL software contains an out-of-bounds write vulnerability in its integrated WibuKey third-party product, tracked as CVE-2026-84854. According to advisory data, the flaw exists in the WibuKey driver where insufficient validation of user input during kernel buffer size calculation could allow small amounts of data to be written outside the intended buffer. This may result in a system crash, denying service, and under unfavorable circumstances, modification of adjacent kernel memory.

The vulnerability affects PSS(R)SINCAL when configured with the legacy WibuKey dongle license type. Affected versions include PSS(R)SINCAL V21.5 (all), V22.0 (all), and PSS(R)SINCAL V22.5 versions prior to V22.5.5. Siemens has assigned a CVSS v3.1 base score of 7.0 (HIGH) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Siemens ProductCERT reported the vulnerability to CISA. Vendor mitigations include installing WIBU Systems WibuKey Runtime for Windows version 6.72 or later. For PSS(R)SINCAL V22.5 users, updating to V22.5 Update 5 or later is recommended. No patch is currently available for V21.5 and V22.0 without the runtime update. CISA recommends minimizing network exposure, isolating control system networks behind firewalls, and using VPNs for remote access where required.