Executive brief
A memory corruption vulnerability exists in Snap7, a popular open-source communication library used to interface with Siemens S7 PLCs (Programmable Logic Controllers). An attacker on the same local network can send a specially crafted request that causes the software to crash or potentially execute unauthorized code. This could lead to a denial-of-service condition, impacting the availability of industrial control systems and manufacturing operations.
Technical details
A stack-based buffer overflow exists in davenardella snap7 up to version 1.4.3 within the TS7Worker::PerformFunctionRead function in src/core/s7_server.cpp. The vulnerability is caused by a mismatch between two different accounting models used during the assembly of a multi-item ReadVar response: ReadArea() decreases the remaining PDU size based on raw data length, while PerformFunctionRead() advances the output cursor using the data length plus headers and padding. An unauthenticated attacker on the adjacent network can exploit this by sending a single ReadVar request with multiple items that satisfy the PDU remainder check but exceed the stack-allocated TS7Answer23 buffer. This results in an out-of-bounds write (memcpy) that can lead to memory corruption or a denial-of-service (DoS).
Affected products
- davenardella snap7 up to 1.4.3
Timeline
- 2026-07-08: disclosed: Vulnerability disclosed via VulDB and GitHub issue report.
- 2026-07-08: advisory