Is CVE-2026-90572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90572 being exploited in the wild.

How severe is CVE-2026-90572?

Medium severity, with a CVSS score of 4.7, published 13 September 2026.

Which products and versions are affected?

davenardella snap7 up to 1.4.3.

Is there a fix for CVE-2026-90572?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90572 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90572?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90572: davenardella snap7 memory corruption in opUpload

CVE-2026-90572 · Severity: medium · CVSS 4.7 · Published 2026-09-13

Snap7 is a library used to communicate with industrial PLC (Programmable Logic Controller) devices via the S7 protocol. A malicious or compromised PLC can send a specially crafted response to trigger memory corruption in the client application, potentially causing crashes or allowing attackers to read sensitive data from memory.

Quick answers

Is CVE-2026-90572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90572 being exploited in the wild.
How severe is CVE-2026-90572?: Medium severity, with a CVSS score of 4.7, published 13 September 2026.
Which products and versions are affected?: davenardella snap7 up to 1.4.3.
Is there a fix for CVE-2026-90572?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90572 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90572?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the TSnap7MicroClient::opUpload() function in src/core/s7_micro_client.cpp, where the function derives the length of a memcpy operation from a server-supplied S7 DataLen header field without validating it. An attacker controlling the PLC server or positioned on the S7 network can craft a response with an invalid DataLen value, leading to either a negative-size memcpy or an out-of-bounds read/write. The vulnerability is reachable on the first Upload response with no prior multi-slice sequence required. Three issues are unchecked: the sign of the Size variable, Size validation against bytes actually received, and validation of Offset + Size against the destination buffer capacity (opData, a 65536-byte buffer). Patches are not yet available as the maintainers have not responded to the issue report.

Affected products

davenardella snap7 up to 1.4.3

Timeline

2026-08-01: disclosed
2026-09-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.