CVE-2026-115723 Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion

High 8.3 Published 23 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-115723?

CVE-2026-115723 is a high-severity vulnerability in davenardella snap7, published on 23 Oct 2026.

Official description

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.

Weakness: CWE-787

Which versions are affected by CVE-2026-115723?

How do I fix CVE-2026-115723?

No fix has been published for CVE-2026-115723 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-115723 being exploited?

There is no known exploitation of CVE-2026-115723 in the wild and no public exploit code.

Sources

Also known as GHSA-m2jh-hr35-v8vp, UBUNTU-CVE-2026-115723.