Medium severity · published Sep 13, 2026
CVE-2026-90572
davenardella snap7 s7_micro_client.cpp opUpload memory corruption
4.7
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was determined in davenardella snap7 up to 1.4.3. The affected element is the function TSnap7MicroClient::opUpload of the file src/core/s7_micro_client.cpp. Executing a manipulation of the argument DataLen can lead to memory corruption. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
snap7 · davenardella
1.4.0; 1.4.1; 1.4.2; 1.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90572
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90572
github.com
https://github.com/davenardella/snap7/
github.com
https://github.com/davenardella/snap7/issues/30
vuldb.com
https://vuldb.com/cve/CVE-2026-90572
vuldb.com
https://vuldb.com/submit/912711
vuldb.com
https://vuldb.com/vuln/403157
vuldb.com
https://vuldb.com/vuln/403157/cti
More from snap7
7.4
CVE-2026-115723
Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
7.4
CVE-2026-111280
snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea
6.3
CVE-2026-16225
davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write
6.3
CVE-2026-15105
davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write