8.8
High
CVE-2022-32137 In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based…
Description
In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Runtime Toolkit 2 | 2 → < 2.4.7.57 | 2.4.7.57 |
| PLCWinNT 2 | 2 → < 2.4.7.57 | 2.4.7.57 |
Other CVEs of Runtime Toolkit
The 13 CVEs of Runtime Toolkit →
CVE-2026-76992
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate…
8.7
High
CVE-2026-79625
Affected products do not properly synchronize access to their monitoring functionality
7.2
High
CVE-2025-41659
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and…
8.3
High
CVE-2025-41658
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due…
5.5
Medium