Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111280snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea

High 7.4

In plain English

A high-severity out-of-bounds write in snap7 from davenardella. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:26.04:LTS	snap7	no fix listed	UBUNTU-CVE-2026-111280
Ubuntu:26.10	snap7	no fix listed	UBUNTU-CVE-2026-111280

Affected products (as reported)

Vendor	Product	Versions
davenardella	snap7	0 – through 1.4.3

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

References

https://github.com/davenardella/snap7/issues/31 issue-tracking
https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_micro_client.cpp#L136-L150 technical-description
https://github.com/davenardella/snap7 product
VulnCheck Advisory: snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea third-party-advisory