---
id: CVE-2026-115723
title: Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
summary: >-
  Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the
  passive partner that allows a malicious active partner to overflow application
  buffers by declaring an unvalidated BSend total length. Attackers connecting
  from the…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: davenardella
product: snap7
affected:
  - snap7 <= 1.4.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T14:48:43.225515Z'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T14:59:52.690Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115723'
references:
  - url: 'https://github.com/davenardella/snap7/pull/41'
  - url: >-
      https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L1126-L1166
  - url: >-
      https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L850-L867
  - url: >-
      https://www.vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-brecv-and-checkasbrecvcompletion
    label: >-
      VulnCheck Advisory: Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and
      CheckAsBRecvCompletion
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.587Z'
---

## Overview

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.

## Affected

- `snap7 <= 1.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.