CVE-2026-111280

Received Received - Intake

Out-of-Bounds Write in snap7 Library

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111280

Affected Vendors & Products

Vendor	Product	Version / Range
davenardella	snap7	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

snap7 through 1.4.3 has an out-of-bounds write flaw in TSnap7MicroClient::opReadArea(). Malicious S7 peers can exploit an unchecked DataLength field to overflow client buffers by sending crafted ReadVar responses. This allows up to 65535 bytes to be copied into caller buffers via memcpy, potentially crashing SCADA, HMI, or gateway processes and corrupting memory.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory writes or crashes in SCADA/HMI systems using snap7. Check for unexpected process terminations or memory corruption in systems running snap7 versions before 1.4.4. Use network traffic analysis to identify malformed S7 protocol responses with oversized DataLength fields.

Impact Analysis

This vulnerability can cause denial-of-service by crashing critical industrial control systems like SCADA or HMI. It may also lead to memory corruption, potentially allowing remote code execution if exploited by rogue PLCs or impersonated devices in the network.

Mitigation Strategies

Upgrade snap7 to version 1.4.4 or later immediately. Isolate S7 protocol traffic using firewalls or network segmentation to prevent rogue PLCs from communicating with clients. Implement input validation for S7 ReadVar responses to reject oversized DataLength fields.

Hi! I’m here to help you understand CVE-2026-111280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70