CVE-2026-15105 is an out-of-bounds write vulnerability affecting davenardella snap7 up to version 1.4.3. The flaw is located in the TS7Worker::PerformFunctionRead function of the src/core/s7_server.cpp file, specifically in the ReadVar Request Handler component. This vulnerability allows an attacker with local network access to cause memory corruption via out-of-bounds write operations. The vulnerability was responsibly disclosed but remains unpatched as of the publication date. Exploit code has been made publicly available, though no active exploitation has been observed.

Successful exploitation can lead to memory corruption due to out-of-bounds write, which may cause application instability or potentially enable further attacks depending on the environment. The attack requires local network access, limiting remote exploitation. No confirmed active exploitation in the wild has been reported.

No official patch or remediation is currently available. Users should restrict local network access to the affected service and monitor for suspicious activity. Since the vendor has not responded or released a fix, organizations should consider isolating or disabling the vulnerable component until a patch is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.