CVE-2026-111280 Details
Description
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
A buffer overflow vulnerability due to an out-of-bounds write has been identified in Snap7 versions through 1.4.3. This vulnerability resides in the function TSnap7MicroClient::opReadArea(). It allows malicious S7 peers to exploit client buffers by sending crafted ReadVar responses with an unchecked DataLength field. This exploitation can lead to the memcpy function transferring up to 65,535 bytes into the application's buffers, causing crashes in SCADA, HMI, or gateway processes, and corrupting memory.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/davenardella/snap7/issues/31 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/davenardella/snap7 | [email protected] | Vendor |
| https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_micro_client.cpp#L136-L150 | [email protected] | Source CodeVendor |
| https://github.com/davenardella/snap7/issues/31 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-tsnap7microclient-opreadarea | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| snap7 | <= 1.4.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |