Description
A security flaw has been discovered in davenardella snap7 up to 1.4.3. The impacted element is the function TSnap7Peer::NegotiatePDULength of the file src/core/s7_peer.cpp. The manipulation of the argument PDULength results in out-of-bounds write. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-07-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the TSnap7Peer::NegotiatePDULength routine of davenardella snap7, where an improperly validated PDULength argument leads to an out-of-bounds write. This memory corruption can corrupt internal structures or trigger unintended execution paths, potentially leading to denial of service or other unintended behavior.

Affected Systems

davenardella Snap7, versions up to 1.4.3, accessed remotely via the default Snap7 interface.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access to the Snap7 service, inferred from the description that the attack can be executed remotely. Once an attacker sends a specially crafted PDULength value over the Snap7 session, the out-of-bounds write can corrupt memory and may lead to a process crash or other unintended behavior.

Generated by OpenCVE AI on July 30, 2026 at 22:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest snap7 release from davenardella that resolves the NegotiatePDULength out-of-bounds write; consult the project’s repository for patch notes.
  • Restrict snap7 access to trusted IP ranges using firewall or network segmentation to mitigate remote exploitation risk.
  • Monitor snap7 logs for anomalous PDULength values or connection attempts and alert on suspicious activity.

Generated by OpenCVE AI on July 30, 2026 at 22:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 19 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in davenardella snap7 up to 1.4.3. The impacted element is the function TSnap7Peer::NegotiatePDULength of the file src/core/s7_peer.cpp. The manipulation of the argument PDULength results in out-of-bounds write. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Title davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write
First Time appeared Davenardella
Davenardella snap7
Weaknesses CWE-119
CWE-787
CPEs cpe:2.3:a:davenardella:snap7:*:*:*:*:*:*:*:*
Vendors & Products Davenardella
Davenardella snap7
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Davenardella Snap7
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-20T13:56:09.501Z

Reserved: 2026-07-18T12:29:33.863Z

Link: CVE-2026-16225

cve-icon Vulnrichment

Updated: 2026-07-20T13:56:04.720Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T22:45:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write