Read the docs
TI-2026-53779 Aliases CVE-2026-76992GHSA-cm9r-92x3-hmfj

Uncontrolled Memory Allocation in CODESYS Gateway Client

Priority MEDIUM 44CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00327 25th percentileScored 2026-11-07
Fix Fixed Development System 3 (CODESYS): 3.5.22.40Gateway (CODESYS): 3.5.22.40+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSDevelopment System 33.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSGateway3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSEdge Gateway for Windows3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSHMI (SL)3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSOPC DA Server SL3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSPLCHandler3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSRuntime Toolkit3.0.0.0 to before 3.5.22.403.5.22.40Patch availableCNA
CODESYSEdge Gateway for Linux3.15.0.0 to before 4.23.0.04.23.0.0Patch availableCNA
  • Development System 3 VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Gateway VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Edge Gateway for Windows VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • HMI (SL) VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • OPC DA Server SL VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • PLCHandler VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Runtime Toolkit VendorCODESYS Affected 3.0.0.0 to before 3.5.22.40 Fixed in 3.5.22.40 Patch available CNA
  • Edge Gateway for Linux VendorCODESYS Affected 3.15.0.0 to before 4.23.0.0 Fixed in 4.23.0.0 Patch available CNA

Remediation

  • Fix · CNA Development System 3 (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Gateway (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Edge Gateway for Windows (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA HMI (SL) (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA OPC DA Server SL (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA PLCHandler (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Runtime Toolkit (CODESYS) Fixed in 3.5.22.40
  • Fix · CNA Edge Gateway for Linux (CODESYS) Fixed in 4.23.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CODESYS Development System 3, HMI (SL), Runtime Toolkit 3.5.22.40

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-55135 Improper Synchronization in Monitoring in CODESYS Control RuntimePriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76992
  2. 2026-10-03 Alias added: GHSA-cm9r-92x3-hmfj

References

Other 1

  • TI-2021-12888 CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-10180 Stack-based buffer overflow in CODESYS V3 web server CVSS 3.1CRITICAL 9.8
  • TI-2021-13604 CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS) CVSS 3.1HIGH 7.5
  • TI-2020-08257 CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-13592 CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2017-03937 Unrestricted file upload in 3S-Smart Software Solutions GmbH CODESYS Web Server CVSS 3.0CRITICAL 9.8
See all 155 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences