CVE-2026-76992— Uncontrolled Memory Allocation in CODESYS Gateway Client
Quick assessment
Affected
CODESYS Development System 3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CODES 网关客户端在分配内存时，依据网关响应中的大小字段进行分配，但未施加适当的上限限制。一个未认证的远程攻击者若控制恶意网关，可利用此行为触发过度的内存消耗，从而导致拒绝服务（DoS）状态，最终造成可用性完全丧失。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76992
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Uncontrolled Memory Allocation in CODESYS Gateway Client
Source: CVE Program / CVE List V5
Vulnerability Description
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| CODESYS | Development System 3 | 3.0.0.0 ~ 3.5.22.40 | - |
|
| CODESYS | Gateway | 3.0.0.0 ~ 3.5.22.40 | - |
|
| CODESYS | Edge Gateway for Windows | 3.0.0.0 ~ 3.5.22.40 | - |
|
| CODESYS | HMI (SL) | 3.0.0.0 ~ 3.5.22.40 | - |
|
| CODESYS | OPC DA Server SL | 3.0.0.0 ~ 3.5.22.40 | - |
|
| CODESYS | PLCHandler | 3.0.0.0 ~ 3.5.22.40 | - |
|
| CODESYS | Runtime Toolkit | 3.0.0.0 ~ 3.5.22.40 | - |
|
| CODESYS | Edge Gateway for Linux | 3.15.0.0 ~ 4.23.0.0 | - |
|
II. Public POCs for CVE-2026-76992
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76992
请登录查看更多情报信息。
Other References for CVE-2026-76992 (1)
IV. Related Vulnerabilities
Same vendor: CODESYS
-
CVE-2026-79625
Improper Synchronization in Monitoring in CODESYS Control Ru -
CVE-2026-35226
Out-of-bounds Write in CODESYS PROFINET Controller -
CVE-2026-8047
Out-of-bounds Write in CODESYS Control -
CVE-2026-8046
Incorrect Authorization in CODESYS Control -
CVE-2026-44469
Incorrect Default Permissions in CODESYS Development System
Same weakness: CWE-770
-
CVE-2026-100508
WordPress Two Factor plugin <= 0.16.0 - Denial of Service At -
CVE-2026-94681
WordPress WP Store Locator plugin < 3.0.0 - Denial of Servic -
CVE-2026-93996
Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP co -
CVE-2026-94002
Apache MINA SSHD: Memory exhaustion in SFTP client via unsol -
CVE-2026-94029
Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-na
V. Comments for CVE-2026-76992
No comments yet