A stack overflow flaw exists in the SICAM SIAPP SDK because the component does not validate input sizes. When an attacker sends oversized or malformed data, the overflow can overwrite control data on the stack, allowing arbitrary code execution and potentially causing a denial of service. This weakness is a buffer overflow vulnerability (CWE‑121).

Siemens SICAM SIAPP SDK is affected. All releases prior to version 2.1.7 are vulnerable. Users of earlier builds should investigate whether the SDK is deployed in their systems and plan an upgrade.

The CVSS score of 7.5 indicates moderate to high severity. The EPSS score is below 1%, suggesting exploitation is unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog, so no active exploitation information is known. Attackers would need to send crafted input to the SDK; no publicly known exploit code exists yet, so local or remote exploitation would likely require access to the SDK’s input channel. The overall risk is moderate, but the potential for arbitrary code execution necessitates prompt remediation.