The vulnerability exists in the function TSnap7MicroClient::opUpload within the file src/core/s7_micro_client.cpp of davenardella snap7 versions 1.4.0 through 1.4.3. Manipulating the DataLen argument passed to this function can cause memory corruption. The issue can be triggered remotely, and the exploit has been publicly disclosed. The project was notified early via an issue report but has not yet provided a fix or response.

Successful exploitation of this vulnerability can lead to memory corruption on the affected system. This may result in application instability, crashes, or potentially arbitrary code execution depending on the context. The vulnerability is remotely exploitable without user interaction and requires high privileges (PR:H). The CVSS 4.0 base score is 5.1, indicating a medium severity impact.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, avoid exposing the vulnerable service to untrusted networks or restrict access to trusted parties only. Consider implementing network-level protections to limit remote exploitation opportunities.