Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-35226 EUVD-2026-50166GHSA-jxhr-7f6w-54g7

Out-of-bounds Write in CODESYS PROFINET Controller

Published Jul 29, 2026 · Updated Jul 29, 2026 · Assigned by CERTVDE

Description

An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime system and results in a controlled stop of the PLC application.

Affected products

VendorProductAffectedFixed
CODESYS CODESYS PROFINET 4.4.0.0 – < 4.8.0.0 4.8.0.0

Advisories 2

References