CVE-2026-51218
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A heap buffer overflow was discovered in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.
Risk Assessment
An attacker can remotely crash the snap7 server, disrupting communication with industrial devices and potentially causing production downtime.
Recommendation
Immediately update snap7 to version 1.4.4 or later if available. If an update is not possible, restrict access to the snap7 server to trusted networks and apply packet filtering.
Other vulnerabilities in snap7
See all- CVE-2026-90572Medium
A vulnerability was determined in davenardella snap7 up to 1.4.3 in the TSnap7MicroClient::opUpload function of src/core/s7_micro_client.cpp. Manipulation of the DataLen argument can lead to memory corruption. The attack can be executed remotely and the exploit has been publicly disclosed. The project was informed but has not responded.
- CVE-2026-16225Medium
A security flaw in snap7 up to version 1.4.3 involves an out-of-bounds write in the TSnap7Peer::NegotiatePDULength function. The attack can be executed remotely by manipulating the PDULength argument.
- CVE-2026-15105Medium
davenardella snap7 up to version 1.4.3 contains an out-of-bounds write vulnerability in the TS7Worker::PerformFunctionRead function. The attack requires local network access. An exploit has been published and may be used.
- CVE-2020-22552High
In Snap7 server version 1.4.1, a vulnerability allows an attacker to send a crafted packet with the COTP protocol where the last-data-unit flag is set to No and the S7 writes a var function, causing the Snap7 server to crash.
Original NVD description (English source)
A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS