CVE-2025-15247
Heap-Based Buffer Overflow in snap7-rs S7Client::download Function
Publication date: 2025-12-30
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gmg137 | snap7-rs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15247 is a critical heap-based buffer overflow vulnerability in the snap7-rs project, specifically in the function snap7_rs::client::S7Client::download. The issue arises because the function uses an unchecked size parameter in a memcpy operation, allowing an attacker to provide a size value that exceeds the actual buffer length. This leads to a heap buffer overflow, where memory beyond the allocated buffer is overwritten. The vulnerability exists in both the native C++ code and the Rust FFI layer, which improperly handles pointers, making exploitation possible remotely without authentication. A proof-of-concept exploit is publicly available. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a remote attacker to execute a heap-based buffer overflow attack on the affected system. This can lead to corruption of memory, potentially causing crashes, denial of service, or execution of arbitrary code. The overflow can compromise the confidentiality, integrity, and availability of the system running the snap7-rs client. Since the exploit is publicly available and requires no authentication, the risk of exploitation is high. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for abnormal crashes or memory errors related to the snap7-rs client, especially in the `S7Client::download` function. Using AddressSanitizer (ASan) during testing can detect heap buffer overflow errors, as it reports read overflows triggered by the vulnerable function. A practical approach is to run the provided Rust test code that reads input data and calls the `download` method unsafely, which can trigger the overflow and be detected by ASan. Network detection might involve monitoring for exploit attempts targeting the snap7-rs client remotely, but no specific network detection commands are provided. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected snap7-rs software with an alternative, as no known countermeasures or patches have been provided yet. Avoid using the vulnerable `S7Client::download` function or restrict access to it to prevent remote exploitation. Monitoring for exploit attempts and applying strict input validation on size parameters if modifying the code are recommended. Since the project has not responded with a fix, consider isolating or disabling the vulnerable component until a patch or update is available. [1]