Snap7 libraries up to version 1.4.3 are vulnerable to an out‑of‑bounds write in passive partner mode. The flaw is triggered when an active partner declares an unvalidated total length for a BSend operation and follows it with a fragment that is shorter than the declared length. The library copies the fragment into a fixed‑size buffer using memcpy without checking bounds, allowing an attacker to write beyond the end of the buffer. The overflow can corrupt memory, potentially leading to a crash or data integrity problems for SCADA, HMI or gateway applications that use Snap7.

The product Snap7 from davenardella, with all releases up to and including 1.4.3, is affected. No additional vendor or product versions are listed, so users of Snap7 1.4.3 or earlier should review this advisory.

The CVSS score of 8.3 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. Attackers must act as an active partner connecting to an address that the Snap7 server trusts, which is typically a SCADA peer. Once connected, a malicious partner can send a packet that declares a large BSend length and then transmit a short fragment, causing memcpy to write past the buffer. This simple exploit path can crash or corrupt the SCADA, HMI or gateway processes and is executable by an attacker with only network access.