CVE-2026-76992
Development System 3: Uncontrolled Memory Allocation in CODESYS Gateway Client
CODESYS Development System 3
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.5.22.40Development System 3CVE List
- 3.5.22.40GatewayCVE List
- 3.5.22.40Edge Gateway for WindowsCVE List
- 3.5.22.40HMI (SL)CVE List
- 3.5.22.40OPC DA Server SLCVE List
- 3.5.22.40PLCHandlerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.
Text from CVE List
Affected versions 8
- Development System 3affected: 3.0.0.0 before 3.5.22.40CVE List
- Gatewayaffected: 3.0.0.0 before 3.5.22.40CVE List
- Edge Gateway for Windowsaffected: 3.0.0.0 before 3.5.22.40CVE List
- HMI (SL)affected: 3.0.0.0 before 3.5.22.40CVE List
- OPC DA Server SLaffected: 3.0.0.0 before 3.5.22.40CVE List
- PLCHandleraffected: 3.0.0.0 before 3.5.22.40CVE List
- Runtime Toolkitaffected: 3.0.0.0 before 3.5.22.40CVE List
- Edge Gateway for Linuxaffected: 3.15.0.0 before 4.23.0.0CVE List