CVE-2025-34226 describes an improper control of a resource through its lifetime (CWE-664) in Autonomy Logic's OpenPLC Runtime version 3.0. The vulnerability arises from insufficient input validation of the epoch_time field during program uploads via the /upload-program-action endpoint. Maliciously crafted inputs can corrupt the programs database. While the runtime continues to operate until restarted, the corrupted database can prevent the runtime from starting after reboot, resulting in a persistent denial of service. The vulnerability was remediated by commit 095ee09.

Successful exploitation leads to persistent denial of service by corrupting the programs database. The runtime operates normally until restart, after which it may fail to start, requiring a full rebase of the product to recover. There is no indication of code execution or data disclosure. The CVSS 4.0 base score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability.

A fix for this vulnerability is available as it was remediated by commit 095ee09. Users should apply the patch or update to a version including this commit to prevent exploitation. Since the product is not a cloud service, remediation is the responsibility of the user. Until patched, avoid uploading programs with untrusted epoch_time values.