TI-2026-79727 Aliases CVE-2026-115723 GHSA-m2jh-hr35-v8vp

Out-of-bounds write in Snap7 lets connected peers overflow buffers

LOW 36CWE-787Published 2026-10-23 · Updated 2026-10-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Snap7 through 1.4.3 from davenardella contains an out-of-bounds write in its passive partner. The BSend total length is not validated, so BRecv copies past the application buffer (CWE-787). A malicious active partner connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, which can crash or corrupt SCADA, HMI or gateway processes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00418 36th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
davenardella	snap7	up to 1.4.3	—	No fix listed	CNA

snap7 Vendordavenardella Affected up to 1.4.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Snap7.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-23 Threatist record created from CVE-2026-115723
2026-10-23 CISA SSVC decision points changed
2026-10-23 Priority changed: MEDIUM → LOW
2026-10-23 Alias added: GHSA-m2jh-hr35-v8vp

References

Patch 1

https://github.com/davenardella/snap7/pull/41

Other 2

TI-2026-75061 snap7 Out-of-Bounds Write via TSnap7MicroClient::opReadArea CVSS 4.0HIGH 8.3
TI-2026-13566 davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write CVSS 4.0MEDIUM 5.3
TI-2026-12717 davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write CVSS 4.0MEDIUM 5.3
TI-2026-61586 davenardella snap7 s7_micro_client.cpp opUpload memory corruption CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences