CVE-2026-90572: Snap7 Library Remote Code Execution Vulnerability

CVE-2026-90572 is a remote code execution vulnerability in the davenardella snap7 library affecting versions up to 1.4.3. Attackers can exploit memory corruption through the TSnap7MicroClient opUpload function. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-90572 Overview

CVE-2026-90572 is a memory corruption vulnerability [CWE-119] in the Snap7 library maintained by davenardella. The flaw affects Snap7 versions up to and including 1.4.3. The vulnerable code resides in the TSnap7MicroClient::opUpload function within src/core/s7_micro_client.cpp. Manipulation of the DataLen argument triggers memory corruption within the client. The issue is reachable over the network, though it requires high privileges to exploit. A public disclosure has been made, and the maintainer has not yet responded to the upstream issue report.

Critical Impact
Attackers with authenticated access can corrupt memory in applications linking Snap7, potentially destabilizing industrial communication clients that speak the S7 protocol to Siemens PLCs.

Affected Products

davenardella Snap7 versions up to 1.4.3
Applications and integrations embedding the Snap7 client library
Industrial control system tooling using TSnap7MicroClient for S7 communications

Discovery Timeline

2026-09-13 - CVE-2026-90572 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90572

Vulnerability Analysis

Snap7 is an open-source communication suite that implements the Siemens S7 protocol used to interact with programmable logic controllers (PLCs). The vulnerable function TSnap7MicroClient::opUpload performs an upload operation from a PLC to the client and processes a caller-supplied DataLen argument. When DataLen is manipulated, the function performs unsafe memory operations that lead to corruption of adjacent memory regions.

The issue is classified as an Improper Restriction of Operations within the Bounds of a Memory Buffer [CWE-119]. Exploitation requires network reachability to the client-side workflow and high privileges on the interacting endpoint. Successful exploitation compromises the integrity of the client process and can crash or destabilize the industrial application consuming Snap7.

Root Cause

The root cause is insufficient validation of the DataLen parameter passed to TSnap7MicroClient::opUpload in src/core/s7_micro_client.cpp. The function processes the length value without enforcing boundary constraints against the destination buffer capacity. This allows out-of-bounds memory access during the upload operation.

Attack Vector

An attacker with the required privilege level and network access to a system running a Snap7-based client can supply a crafted DataLen value during an S7 upload exchange. The malformed argument reaches the vulnerable code path in the micro-client and corrupts process memory. The technical details, including a public disclosure, are documented in VulDB Vulnerability #403157 and the upstream GitHub Snap7 Issue #30.

No verified proof-of-concept code is included in the enriched dataset. See the upstream GitHub Snap7 Repository and the VulDB CVE-2026-90572 entry for further technical context.

Detection Methods for CVE-2026-90572

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking the Snap7 client library.
Anomalous S7 protocol traffic (TCP port 102) containing oversized or malformed DataLen fields during upload operations.
Repeated abnormal disconnects between engineering workstations and PLCs following Snap7 client calls.

Detection Strategies

Inventory all binaries and applications that statically or dynamically link Snap7 at version 1.4.3 or earlier.
Deploy protocol-aware inspection on operational technology (OT) network segments to flag malformed S7 protocol data unit (PDU) lengths.
Enable core dump collection on hosts running Snap7-based clients so that memory corruption events can be triaged.

Monitoring Recommendations

Monitor Snap7 client processes for abnormal termination patterns and correlate with S7 session activity.
Alert on S7 traffic originating from unexpected sources or accounts, given that exploitation requires privileged access.
Track project releases at the GitHub Snap7 Repository for a patched version, since the maintainer has not yet responded.

How to Mitigate CVE-2026-90572

Immediate Actions Required

Restrict which accounts and hosts can initiate S7 upload operations to Snap7-based clients.
Segment OT networks so that S7 traffic (TCP port 102) is limited to authorized engineering workstations and PLCs.
Audit third-party ICS tooling for embedded copies of Snap7 1.4.3 and older, and constrain their exposure.

Patch Information

No official patch is available at the time of publication. According to the CVE description, the project was informed through an upstream issue report but has not responded. Monitor the GitHub Snap7 Repository and the tracked GitHub Snap7 Issue #30 for a fix.

Workarounds

Enforce strict network access control lists so only trusted engineering hosts can reach systems running Snap7 clients.
Require strong authentication and least-privilege enforcement on any account with access to industrial workstations, since exploitation requires high privileges.
Where feasible, rebuild Snap7 from source with additional bounds checks on DataLen inside TSnap7MicroClient::opUpload until an upstream fix is available.
Isolate legacy or unmaintained Snap7-based tooling on dedicated hosts with reduced network exposure.

bash

# Example: restrict S7 protocol traffic (TCP/102) to a known engineering host
iptables -A INPUT -p tcp --dport 102 -s 10.10.20.15 -j ACCEPT
iptables -A INPUT -p tcp --dport 102 -j DROP