snap7: Out-of-bounds write in TSnap7MicroClient::opReadArea
Summary
The snap7 library, used to communicate with Siemens S7 PLCs, contains an out-of-bounds write in the client function TSnap7MicroClient::opReadArea. An attacker controlling or impersonating a PLC can send a crafted ReadVar response with an oversized DataLength field, causing up to 65535 bytes to be copied into client buffers. This can crash SCADA, HMI or gateway processes and corrupt memory. Exploitation requires a rogue or impersonated PLC or a position on the network path to it.
Affected
- snap7 versions 0 through 1.4.3
- Ubuntu packages 1.4.2+dfsg-1 and 1.4.2+dfsg-1build1 are listed as affected, status needs evaluation
Fixed in
Unknown. No fixed release, commit or vendor patch has been confirmed.
Workaround
Unknown. No vendor workaround has been confirmed. Generic measures: restrict snap7 clients to segmented OT networks and limit port 102 to known engineering and HMI hosts.
Exploitation
- CISA SSVC: exploitation status PoC, automatable no, technical impact partial
- No evidence of exploitation in the wild found
- No public proof of concept found
- CISA KEV status not verified
Our recommendation
- Inventory systems that use snap7 or python-snap7, including embedded SCADA, HMI and gateway software
- Ask software vendors whether their products bundle snap7 and whether a fix is available
- Restrict PLC network paths to known peers and segment OT networks
- Monitor for crashes or unexpected behaviour in snap7-based processes
- Check the GitHub repository and advisories regularly for a fixed version
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-111280 Ubuntu security ubuntu.com
- VulnCheck advisory www.vulncheck.com
- snap7 GitHub issue #31 github.com
- snap7 repository github.com
- OSV UBUNTU-CVE-2026-111280 osv.dev
- Mend CVE-2026-111280 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:41.
Original description (NVD)
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
NVD references (5)
- https://github.com/davenardella/snap7
- https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_micro_client.…
- https://github.com/davenardella/snap7/issues/31
- https://www.vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-tsnap7microclient-opreadarea
- https://github.com/davenardella/snap7/issues/31
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.