Medium severity · published Jul 8, 2026
CVE-2026-15105
davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw has been found in davenardella snap7 up to 1.4.3. This affects the function TS7Worker::PerformFunctionRead of the file src/core/s7_server.cpp of the component ReadVar Request Handler. This manipulation causes out-of-bounds write. The attack requires access to the local network. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
snap7 · davenardella
1.4.0; 1.4.1; 1.4.2; 1.4.3 · source: vendor
Affected product
SN
snap7
davenardella
More from snap7
7.4
CVE-2026-115723
Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
7.4
CVE-2026-111280
snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea
6.3
CVE-2026-16225
davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write
4.7
CVE-2026-90572
davenardella snap7 s7_micro_client.cpp opUpload memory corruption