# CVE-2026-90572: davenardella snap7 memory corruption in opUpload

Source: https://junglewise.ai/threats/cve-2026-90572-davenardella-snap7-memory-corruption-in-opupload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90572 · Severity: medium · CVSS 4.7 · Published 2026-09-13

Snap7 is a library used to communicate with industrial PLC (Programmable Logic Controller) devices via the S7 protocol. A malicious or compromised PLC can send a specially crafted response to trigger memory corruption in the client application, potentially causing crashes or allowing attackers to read sensitive data from memory.

## Quick answers

**Is CVE-2026-90572 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90572 being exploited in the wild.

**How severe is CVE-2026-90572?** Medium severity, with a CVSS score of 4.7, published 13 September 2026.

**Which products and versions are affected?** davenardella snap7 up to 1.4.3.

**Is there a fix for CVE-2026-90572?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90572 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-90572?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the TSnap7MicroClient::opUpload() function in src/core/s7_micro_client.cpp, where the function derives the length of a memcpy operation from a server-supplied S7 DataLen header field without validating it. An attacker controlling the PLC server or positioned on the S7 network can craft a response with an invalid DataLen value, leading to either a negative-size memcpy or an out-of-bounds read/write. The vulnerability is reachable on the first Upload response with no prior multi-slice sequence required. Three issues are unchecked: the sign of the Size variable, Size validation against bytes actually received, and validation of Offset + Size against the destination buffer capacity (opData, a 65536-byte buffer). Patches are not yet available as the maintainers have not responded to the issue report.

## Affected products

- davenardella snap7 up to 1.4.3

## Timeline

- 2026-08-01: disclosed
- 2026-09-13: advisory

## References

- [https://github.com/davenardella/snap7/](https://github.com/davenardella/snap7/)
- [https://github.com/davenardella/snap7/issues/30](https://github.com/davenardella/snap7/issues/30)