CVE-2026-16225 Details
Description
A security flaw has been discovered in davenardella snap7 up to 1.4.3. The impacted element is the function TSnap7Peer::NegotiatePDULength of the file src/core/s7_peer.cpp. The manipulation of the argument PDULength results in out-of-bounds write. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
A security vulnerability allowing for an out-of-bounds write has been identified in Snap7 versions prior to 1.4.3. The issue arises in the TSnap7Peer::NegotiatePDULength function within the file src/core/s7_peer.cpp. The vulnerability is triggered by manipulating the PDULength argument, leading to an out-of-bounds write. This flaw can be exploited remotely, and a public exploit is available.
To address this vulnerability, the negotiated PDU length should be capped at the maximum allowable size before it is accepted. Additionally, a bounds check should be implemented in the opWriteArea function to ensure that the data being written does not exceed the capacity of the payload buffer.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 19, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/davenardella/snap7/ | [email protected] | ProductSource CodeVendor |
| https://github.com/davenardella/snap7/issues/17 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-16225 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/858228 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/380047 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/380047/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| davenardella snap7 | <= 1.4.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 19, 2026 | New CVE Received | [email protected] |