CODESYS Gateway Client - Uncontrolled Memory Allocation
[Advisory2026-11_VDE-2026-094] The CODESYS Gateway Client (CmpGatewayClient) is used by various CODESYS products to establish PLC communication via the CODESYS Gateway. Due to missing limits on memory allocations derived from a size field in a gateway response, a malicious gateway can cause excessive memory consumption in the client, resulting in a denial-of-service condition. The vulnerability can be exploited when an affected product connects to an attacker-controlled gateway.
EPSS 0.00 CVE-2026-76992 CODESYS DE