Executive brief
Snap7 is an open-source communication library used to connect software applications with Siemens S7 PLCs (Industrial Controllers). A security flaw allows a malicious server or a network attacker to send a specially crafted message that causes the Snap7 client to crash or corrupt its own memory. This could lead to a denial of service for industrial monitoring systems or potentially allow for further unauthorized actions on the system running the Snap7 client.
Technical details
A client-side intra-object heap overflow exists in davenardella snap7 up to version 1.4.3. The vulnerability is rooted in TSnap7Peer::NegotiatePDULength within src/core/s7_peer.cpp, where the library fails to enforce an upper bound on the PDULength negotiated with a server. An attacker-controlled server can provide an excessively large PDULength, which is subsequently used by TSnap7MicroClient::opWriteArea() to calculate buffer offsets for a memcpy operation. This results in an out-of-bounds write when the client attempts to assemble a local request buffer, leading to heap corruption or a process crash. The exploit is public and requires the attacker to either control the server or intercept the network traffic (man-in-the-middle).
Affected products
- davenardella snap7 up to 1.4.3
Timeline
- 2026-07-19: disclosed: Initial disclosure via VulDB and NVD
- 2026-07-19: advisory