Vulnerability · Published Jul 29, 2026 · Assigned by CERTVDE
CVE-2026-35226Out-of-bounds Write in CODESYS PROFINET Controller
Medium 6.5
In plain English
A medium-severity out-of-bounds write in CODESYS PROFINET from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime system and results in a controlled stop of the PLC application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS PROFINET | 4.4.0.0 – before 4.8.0.0 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H