8.7
High
CVE-2026-76992 The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate…
Description
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Development System 3 3.0 | 3.0.0.0 → < 3.5.22.40 | 3.5.22.40 |
| Gateway 3.0 | 3.0.0.0 → < 3.5.22.40 | 3.5.22.40 |
| Edge Gateway for Windows 3.0 | 3.0.0.0 → < 3.5.22.40 | 3.5.22.40 |
| HMI (SL) 3.0 | 3.0.0.0 → < 3.5.22.40 | 3.5.22.40 |
| OPC DA Server SL 3.0 | 3.0.0.0 → < 3.5.22.40 | 3.5.22.40 |
| PLCHandler 3.0 | 3.0.0.0 → < 3.5.22.40 | 3.5.22.40 |
| Runtime Toolkit 3.0 | 3.0.0.0 → < 3.5.22.40 | 3.5.22.40 |
| Edge Gateway for Linux 3.15 | 3.15.0.0 → < 4.23.0.0 | 4.23.0.0 |