CVE-2026-90572: davenardella snap7 s7_micro_client.cpp opUpload memory corruption
A vulnerability was determined in davenardella snap7 up to 1.4.3. The affected element is the function TSnap7MicroClient::opUpload of the file src/core/s7microclient.cpp. Executing a manipulation of the argument DataLen can lead to memory corruption. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which releases should be considered affected?
The issue affects davenardella snap7 versions up to and including 1.4.3. The provided information does not identify a fixed release.
What access does an attacker need to exploit this issue?
The attack is described as remote and requires no user interaction. The supplied CVSS vector indicates that the attacker must already have high privileges.
Is exploitation likely to be practical?
A public exploit disclosure is reported, and the exploit may be used. Successful exploitation can affect confidentiality, integrity, and availability at low impact levels according to the supplied CVSS metrics.
What is known about remediation?
The project was reportedly notified through an issue report but had not responded at the time of publication. No workaround or vendor-provided remediation is included in the available information.