Description
An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS Development System V2.3 | < 2.3.9.73 | 2.3.9.73 |
Advisories 4
- ICSA-26-076-01 CODESYS in Festo Automation Suite CISA ICS & IT advisories · Mar 17, 2026
- FSA-202601 Several CODESYS vulnerabilities in Festo Automation Suite CERT@VDE · Feb 26, 2026
- VDE-2024-024 CODESYS: Development System V2.3 affected by two vulnerabilities through corrupted project files CERT@VDE · May 14, 2025
- WID-SEC-2024-1026 CODESYS: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 5, 2024