CVE-2025-41738 CODESYS Control - Invalid type usage in visualization

What is CVE-2025-41738?

CVE-2025-41738 is a high-severity memory corruption vulnerability in Codesys Control for Beaglebone Sl, published on 1 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.

Weakness: CWE-843

Which versions are affected by CVE-2025-41738?

It affects 17 products.

Products include Codesys Control for Beaglebone Sl, Codesys Control for Empc-A\/Imx6 Sl, Codesys Control for Iot2000 Sl, Codesys Control for Linux Arm Sl, Codesys Control for Linux Sl, Codesys Control for Pfc100 Sl and 11 more.

How do I fix CVE-2025-41738?

No fix has been published for CVE-2025-41738 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-41738 being exploited?

There is no known exploitation of CVE-2025-41738 in the wild and no public exploit code.

Other vulnerabilities in Codesys Control for Beaglebone Sl

• CVE-2019-9010 Missing authorization in n/a Critical 9.8
• CVE-2018-10612 Misconfiguration in 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0 Critical 9.8
• CVE-2023-6357 OS Command Injection in multiple CODESYS products High 8.8
• CVE-2022-4046 CODESYS: Improper memory restrictions fro CODESYS Control High 8.8
• CVE-2022-47379 CODESYS: Multiple products prone to out-of-bounds write High 8.8

All Codesys Control for Beaglebone Sl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7pvj-rp26-vxxc.