# CVE-2026-15105: davenardella snap7 stack buffer overflow in TS7Worker::PerformFunctionRead

Source: https://junglewise.ai/threats/cve-2026-15105-davenardella-snap7-stack-buffer-overflow-in-ts7worker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-15105 · Severity: medium · CVSS 6.3 · Published 2026-07-08

A memory corruption vulnerability exists in Snap7, a popular open-source communication library used to interface with Siemens S7 PLCs (Programmable Logic Controllers). An attacker on the same local network can send a specially crafted request that causes the software to crash or potentially execute unauthorized code. This could lead to a denial-of-service condition, impacting the availability of industrial control systems and manufacturing operations.

## Quick answers

**Is CVE-2026-15105 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15105 being exploited in the wild.

**How severe is CVE-2026-15105?** Medium severity, with a CVSS score of 6.3, published 8 July 2026.

**Which products and versions are affected?** davenardella snap7 up to 1.4.3.

**Is there a fix for CVE-2026-15105?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15105 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-15105?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in davenardella snap7 up to version 1.4.3 within the TS7Worker::PerformFunctionRead function in src/core/s7_server.cpp. The vulnerability is caused by a mismatch between two different accounting models used during the assembly of a multi-item ReadVar response: ReadArea() decreases the remaining PDU size based on raw data length, while PerformFunctionRead() advances the output cursor using the data length plus headers and padding. An unauthenticated attacker on the adjacent network can exploit this by sending a single ReadVar request with multiple items that satisfy the PDU remainder check but exceed the stack-allocated TS7Answer23 buffer. This results in an out-of-bounds write (memcpy) that can lead to memory corruption or a denial-of-service (DoS).

## Affected products

- davenardella snap7 up to 1.4.3

## Timeline

- 2026-07-08: disclosed: Vulnerability disclosed via VulDB and GitHub issue report.
- 2026-07-08: advisory

## References

- [https://github.com/davenardella/snap7/](https://github.com/davenardella/snap7/)
- [https://github.com/davenardella/snap7/issues/16](https://github.com/davenardella/snap7/issues/16)
- [https://github.com/user-attachments/files/28681740/poc.zip](https://github.com/user-attachments/files/28681740/poc.zip)
- [https://vuldb.com/cve/CVE-2026-15105](https://vuldb.com/cve/CVE-2026-15105)
- [https://vuldb.com/submit/851026](https://vuldb.com/submit/851026)
- [https://vuldb.com/vuln/376946](https://vuldb.com/vuln/376946)
- [https://vuldb.com/vuln/376946/cti](https://vuldb.com/vuln/376946/cti)