EUVD-2026-45435
GHSA-cc6f-5g4h-cf75
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low-privilege requirement per CVSS 4.0 PR:L; limited C/I/A impacts are consistent with the constrained scope indicated by VC:L/VI:L/VA:L in the 4.0 vector.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in davenardella snap7 up to 1.4.3. The impacted element is the function TSnap7Peer::NegotiatePDULength of the file src/core/s7_peer.cpp. The manipulation of the argument PDULength results in out-of-bounds write. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Out-of-bounds write in davenardella snap7 up to version 1.4.3 allows network-authenticated attackers to corrupt memory by supplying a crafted PDULength value during S7 protocol negotiation. The vulnerable function TSnap7Peer::NegotiatePDULength in src/core/s7_peer.cpp fails to enforce bounds on the PDULength argument, enabling writes beyond the allocated buffer boundary. A public proof-of-concept exploit is available on GitHub (issue #17), and the CVSS 4.0 E:P modifier confirms this - elevating practical risk above the medium base score, particularly in OT/ICS deployments where snap7 is commonly used to interface with Siemens S7 PLCs.
Technical ContextAI
snap7 is an open-source C++ library (CPE: cpe:2.3:a:davenardella:snap7:*:*:*:*:*:*:*:*) implementing the S7 communication protocol used to exchange data with Siemens S7-series Programmable Logic Controllers in industrial control system (ICS) and SCADA environments. The root cause is CWE-787 (Out-of-Bounds Write): during the S7 connection handshake, the TSnap7Peer::NegotiatePDULength function processes a caller-supplied PDULength parameter without adequate bounds validation, allowing a write operation to extend beyond the end of the allocated buffer. This class of memory corruption (tagged Memory Corruption / Buffer Overflow) can manifest as process crashes, heap metadata corruption, or - under controlled conditions - arbitrary code execution, depending on allocator layout and exploit sophistication.
RemediationAI
No vendor-released patch version has been identified at time of analysis - the affected version ceiling is 1.4.3 and no fixed release is referenced in the available data. The public exploit was disclosed via GitHub issue #17 (https://github.com/davenardella/snap7/issues/17), which should be monitored for an upstream code fix or tagged release. As compensating controls: restrict network access to snap7-enabled hosts via firewall or network segmentation rules that allow only authorized S7 clients to initiate connections - this directly narrows the PR:L attack surface by limiting which principals can reach the negotiation endpoint. Deploy snap7-based applications behind a VPN or in isolated OT network segments inaccessible from untrusted networks. If snap7 is running in server/peer mode unnecessarily, disabling inbound S7 listener functionality eliminates the attack path entirely. Monitor snap7 processes for unexpected restarts or crashes as an indicator of exploitation attempts. Containerizing or sandboxing snap7 processes limits the blast radius if memory corruption is achieved. Check https://github.com/davenardella/snap7/ directly for any patches or releases published after CVE assignment.
The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-un
Memory corruption in davenardella snap7 up to version 1.4.3 allows a network-accessible, high-privileged attacker to cor
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today