PatchTheCVECVE-2026-115723: Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicio
CVE-2026-115723 is a high-severity flaw (CVSS 7.4) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.4 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 51%) |
| CISA exploited list | No |
| Weakness | CWE-787 |
| Published | 2026-10-23 |
| Last modified | 2026-10-23 |
Last updated 2026-10-23 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-115723?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-115723 being exploited?
CVE-2026-115723 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-115723 affect?
CVE-2026-115723 affects affected software. Severity is high (CVSS 7.4). Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the co
How urgent is CVE-2026-115723?
Priority 43/100. High severity; Remotely exploitable, no login, no user action