7.5High
CVE-2026-76992Uncontrolled Memory Allocation in CODESYS Gateway Client
Description
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.
Weakness (CWE):
CWE-770
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| codesys | codesys development system 3 | 3.0.0.0 – < 3.5.22.40 | |
| codesys | codesys edge gateway for linux | 3.15.0.0 – < 4.23.0.0 | |
| codesys | codesys edge gateway for windows | 3.0.0.0 – < 3.5.22.40 | |
| codesys | codesys gateway | 3.0.0.0 – < 3.5.22.40 | |
| codesys | codesys hmi sl | 3.0.0.0 – < 3.5.22.40 | |
| codesys | codesys opc da server sl | 3.0.0.0 – < 3.5.22.40 | |
| codesys | codesys plchandler | 3.0.0.0 – < 3.5.22.40 | |
| codesys | codesys runtime toolkit | 3.0.0.0 – < 3.5.22.40 | |
| CODESYS | Development System 3 | 3.0.0.0 – < 3.5.22.40 | |
| CODESYS | Edge Gateway for Linux | 3.15.0.0 – < 4.23.0.0 | |
| CODESYS | Edge Gateway for Windows | 3.0.0.0 – < 3.5.22.40 | |
| CODESYS | Gateway | 3.0.0.0 – < 3.5.22.40 | |
| CODESYS | HMI (SL) | 3.0.0.0 – < 3.5.22.40 | |
| CODESYS | OPC DA Server SL | 3.0.0.0 – < 3.5.22.40 | |
| CODESYS | PLCHandler | 3.0.0.0 – < 3.5.22.40 | |
| CODESYS | Runtime Toolkit | 3.0.0.0 – < 3.5.22.40 |