CVE-2026-16225
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A security flaw in snap7 up to version 1.4.3 involves an out-of-bounds write in the TSnap7Peer::NegotiatePDULength function. The attack can be executed remotely by manipulating the PDULength argument.
Risk Assessment
The organization is at risk of remote code execution or system crash, potentially leading to application takeover or data leakage. A publicly available exploit increases the attack likelihood.
Recommendation
Immediately update snap7 to version 1.4.4 or later if available. If an update is not possible, restrict access to the service to trusted networks only.
Other vulnerabilities in snap7
See all- CVE-2026-15105Medium
davenardella snap7 up to version 1.4.3 contains an out-of-bounds write vulnerability in the TS7Worker::PerformFunctionRead function. The attack requires local network access. An exploit has been published and may be used.
- CVE-2026-51218High
A heap buffer overflow was discovered in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.
- CVE-2020-22552High
In Snap7 server version 1.4.1, a vulnerability allows an attacker to send a crafted packet with the COTP protocol where the last-data-unit flag is set to No and the S7 writes a var function, causing the Snap7 server to crash.
Original NVD description (English source)
A security flaw has been discovered in davenardella snap7 up to 1.4.3. The impacted element is the function TSnap7Peer::NegotiatePDULength of the file src/core/s7_peer.cpp. The manipulation of the argument PDULength results in out-of-bounds write. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.