CVE-2026-115723
Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
davenardella snap7
CVSS
8.3HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
Text from CVE List
Affected versions 1
- snap7affected: all versions through 1.4.3CVE List
References 4
- github.com/davenardella/snap7/pull/41Fixvia CVE List
- vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-brecv-and-checkasbrecvcompletionAdvisoryvia CVE List
- github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L1126-L1166Referencevia CVE List
- github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L850-L867Referencevia CVE List