---
id: "CVE-2026-115723"
kind: "vulnerability"
aliases: ["CVE-2026-115723"]
title: "Snap7: out-of-bounds write lets a peer crash or corrupt SCADA processes"
severity: "high"
cvss: 8.3
epss: 0.00617
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["hmi", "industrial-control", "other", "s7-protocol", "scada", "self-hosted", "snap7"]
not_affected_if: ["no-snap7-passive-partner", "peer-address-restricted"]
published_at: "2026-10-23T12:18:12+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115723", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115723", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Snap7: out-of-bounds write lets a peer crash or corrupt SCADA processes

Snap7 through 1.4.3 does not validate the declared total length in BSend, so a malicious active partner can make the passive partner's BRecv copy memory past its buffer. An attacker connecting from the configured peer address can crash or corrupt SCADA, HMI or gateway processes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Snap7 version in use: `unknown` if the sources do not give a command or file to look at
- Confirm whether the application runs the Snap7 passive partner (server) and which peer addresses it accepts

## Fix

- Upgrade Snap7 past `1.4.3`: the fixed version is unknown from the sources
- Restrict which peer addresses may connect to the passive partner until a fix is applied

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115723
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115723

## From the sources

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_