High severity · published Oct 15, 2026
CVE-2026-111280
snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea
7.4
CVSS
0.5%
EPSS
No
On KEV
Description
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
snap7 · davenardella
through 1.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111280
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111280
github.com
https://github.com/davenardella/snap7
github.com
https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_micro_client.cpp#L136-L150
github.com
https://github.com/davenardella/snap7/issues/31
www.vulncheck.com
https://www.vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-tsnap7microclient-opreadarea
More from snap7
7.4
CVE-2026-115723
Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
6.3
CVE-2026-16225
davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write
6.3
CVE-2026-15105
davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write
4.7
CVE-2026-90572
davenardella snap7 s7_micro_client.cpp opUpload memory corruption