CVE-2026-111280: snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
SCADA, HMI, and gateway processes that use affected snap7 clients and issue ReadVar requests to an S7 peer are exposed. The vulnerable behavior is in the client-side handling of peer responses.
What does an attacker need to exploit it?
An attacker needs to act as, control, or impersonate an S7 peer that can send a crafted ReadVar response to the snap7 client. The malicious response uses an unchecked DataLength field to cause a memcpy of up to 65535 bytes into the caller buffer.
Is authentication or user interaction required?
No privileges or user interaction are required according to the supplied vector. Exploitation still requires the attacker to deliver the crafted response as the S7 peer.
How can this affect an affected process?
A crafted response can overflow the client buffer, potentially crashing the SCADA, HMI, or gateway process and corrupting its memory. The reported impact includes integrity and availability effects.