CVE-2026-115723: high-severity vulnerability in davenardella snap7
Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.3epss 0.4%
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
davenardella · snap7Related CVEs — davenardella snap7
In the same product, most dangerous first.
CVE-2026-111280HIGHsnap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadAreaEPSS 0.5%CVE-2026-90572MEDIUMdavenardella snap7 s7_micro_client.cpp opUpload memory corruptionEPSS 0.4%CVE-2026-16225MEDIUMdavenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds writeEPSS 0.4%CVE-2026-15105MEDIUMdavenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds writeEPSS 0.4%
References
https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L1126-L1166https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L850-L867https://github.com/davenardella/snap7/pull/41https://www.vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-brecv-and-checkasbrecvcompletion