Out-of-Bounds Write Vulnerability in Snap7 by Davenardella

CVE-2026-111280

What is CVE-2026-111280?

Snap7 versions up to 1.4.3 are susceptible to an out-of-bounds write vulnerability in the TSnap7MicroClient::opReadArea function. This flaw allows malicious S7 peers to exploit an unchecked DataLength field, leading to potential buffer overflows. By sending crafted ReadVar responses, unauthorized or impersonated PLCs can initiate a memory overflow of up to 65,535 bytes into the caller buffers, resulting in the crashing of SCADA, HMI, or gateway processes and subsequent memory corruption.

References