CVE-2025-15247

Unknown Unknown - Not Provided

Heap-Based Buffer Overflow in snap7-rs S7Client::download Function

Publication date: 2025-12-30

Last updated on: 2026-04-29

Assigner: VulDB

Description

A vulnerability was identified in gmg137 snap7-rs up to 153d3e8c16decd7271e2a5b2e3da4d6f68589424. Affected by this issue is the function snap7_rs::client::S7Client::download of the file client.rs. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-30

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2025-12-30

EPSS Evaluated

2026-07-04

NVD

CVE-2025-15247

Affected Vendors & Products

Vendor	Product	Version / Range
gmg137	snap7-rs	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

CVE-2025-15247 is a critical heap-based buffer overflow vulnerability in the snap7-rs project, specifically in the function snap7_rs::client::S7Client::download. The issue arises because the function uses an unchecked size parameter in a memcpy operation, allowing an attacker to provide a size value that exceeds the actual buffer length. This leads to a heap buffer overflow, where memory beyond the allocated buffer is overwritten. The vulnerability exists in both the native C++ code and the Rust FFI layer, which improperly handles pointers, making exploitation possible remotely without authentication. A proof-of-concept exploit is publicly available. [1, 2]

Impact Analysis

This vulnerability can impact you by allowing a remote attacker to execute a heap-based buffer overflow attack on the affected system. This can lead to corruption of memory, potentially causing crashes, denial of service, or execution of arbitrary code. The overflow can compromise the confidentiality, integrity, and availability of the system running the snap7-rs client. Since the exploit is publicly available and requires no authentication, the risk of exploitation is high. [1, 2]

Detection Guidance

This vulnerability can be detected by monitoring for abnormal crashes or memory errors related to the snap7-rs client, especially in the `S7Client::download` function. Using AddressSanitizer (ASan) during testing can detect heap buffer overflow errors, as it reports read overflows triggered by the vulnerable function. A practical approach is to run the provided Rust test code that reads input data and calls the `download` method unsafely, which can trigger the overflow and be detected by ASan. Network detection might involve monitoring for exploit attempts targeting the snap7-rs client remotely, but no specific network detection commands are provided. [2]

Mitigation Strategies

Immediate mitigation steps include replacing the affected snap7-rs software with an alternative, as no known countermeasures or patches have been provided yet. Avoid using the vulnerable `S7Client::download` function or restrict access to it to prevent remote exploitation. Monitoring for exploit attempts and applying strict input validation on size parameters if modifying the code are recommended. Since the project has not responded with a fix, consider isolating or disabling the vulnerable component until a patch or update is available. [1]

Hi! I’m here to help you understand CVE-2025-15247. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70