Snap7: Out-of-bounds write in passive partner via BRecv
Summary
Snap7 through version 1.4.3 contains an out-of-bounds write in the passive partner (server side). A peer that is allowed to connect can declare an unvalidated BSend total length of up to 65535 bytes and send a short fragment, so that BRecv copies data past the application buffer. This can crash or corrupt SCADA, HMI or gateway processes that use the library.
Affected
- Snap7 (davenardella/snap7) versions 0 to 1.4.3 inclusive
- Vulnerable code at commit 30f37da, src/core/s7_partner.cpp
- Unofficial forks may contain the same code
Fixed in
Unknown. A pull request (#41) is referenced, but its merge status and a fixed release were not confirmed.
Workaround
- Allow only known peer IP addresses to connect to the passive partner
- Firewall TCP port 102 (S7) so that only known PLCs or gateways can reach it
- Bind the listener to a specific internal interface instead of 0.0.0.0
- Keep S7 traffic inside OT segments and do not route it from IT or the internet
Exploitation
- Not known to be exploited; not listed in CISA KEV
- No public proof of concept found for this CVE
- CISA SSVC: exploitation none, automatable no, technical impact partial
Our recommendation
- Inventory all applications and products that embed Snap7 or the Snap7 library
- Ask vendors whether they ship a patched build and install it when available
- Check PR #41 and the upstream repository for a fixed release after 1.4.3
- Restrict and monitor access to the S7 partner port until a fix is in place
- Monitor for unexpected connections and crashes in SCADA, HMI and gateway processes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record details (Ubuntu) ubuntu.com
- VulDB entry vuldb.com
- VulnCheck advisory www.vulncheck.com
- Snap7 pull request #41 github.com
- Snap7 s7_partner.cpp at commit 30f37da (BRecv) github.com
- HOL Guard CVE entry hol.org
- Snap7 upstream repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:17.
Original description (NVD)
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
NVD references (4)
- https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L…
- https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L…
- https://github.com/davenardella/snap7/pull/41
- https://www.vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-brecv-and-checkasbrecvcomple…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.