Read the docs
TI-2026-75061 Aliases CVE-2026-111280

snap7 Out-of-Bounds Write via TSnap7MicroClient::opReadArea

Priority HIGH 69CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

snap7 through 1.4.3 contains an out-of-bounds write in TSnap7MicroClient::opReadArea(). The function does not check the DataLength field of S7 responses, so a malicious or impersonated PLC can send a crafted ReadVar response that makes the client memcpy up to 65535 bytes into caller buffers. The result is a crash of SCADA, HMI or gateway processes and memory corruption. The CVSS 4.0 base score is 8.3 (HIGH), and the SSVC assessment lists a proof of concept with partial technical impact that is not automatable.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0051 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
davenardellasnap7up to 1.4.3—No fix listedCNA
  • snap7 Vendordavenardella Affected up to 1.4.3 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for snap7 in the affected range through 1.4.3. Restrict which hosts can act as S7 peers for the client, and keep untrusted or unauthenticated PLCs off the network segment where snap7 clients run.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111280
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-23 CISA SSVC decision points changed
  4. 2026-10-23 Priority changed: LOW → HIGH

References

Other 3

  • TI-2026-13566 davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write CVSS 4.0MEDIUM 5.3
  • TI-2026-12717 davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write CVSS 4.0MEDIUM 5.3
  • TI-2026-61586 davenardella snap7 s7_micro_client.cpp opUpload memory corruption CVSS 4.0MEDIUM 5.1
  • TI-2026-79727 Out-of-bounds write in Snap7 lets connected peers overflow buffers CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences