{"schema_version":"1","data":[{"id":4525,"advisory_id":"7332d3ae-438e-4012-b7d2-7693405d14fa","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76992","source_published_at":"2026-09-30T11:07:45.751+00:00","published_at":"2026-10-24T21:53:18.964077+00:00","extraction_method":"structured","technologies":["core-cve","development-system-3","edge-gateway-for-linux","edge-gateway-for-windows","gateway","hmi-sl","opc-da-server-sl","plchandler","runtime-toolkit"],"cve_ids":["CVE-2026-76992"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Uncontrolled Memory Allocation in CODESYS Gateway Client","summary":"The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.","evidence":"cve:CVE-2026-76992","products":[{"name":{"value":"Development System 3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Gateway","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Edge Gateway for Windows","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"HMI (SL)","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OPC DA Server SL","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"PLCHandler","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Runtime Toolkit","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Edge Gateway for Linux","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-76992","aliases":["CVE-2026-76992"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"CODESYS","product":"Development System 3","versions":[{"status":"affected","version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic"}],"defaultStatus":"unaffected"},{"vendor":"CODESYS","product":"Gateway","versions":[{"status":"affected","version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic"}],"defaultStatus":"unaffected"},{"vendor":"CODESYS","product":"Edge Gateway for Windows","versions":[{"status":"affected","version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic"}],"defaultStatus":"unaffected"},{"vendor":"CODESYS","product":"HMI (SL)","versions":[{"status":"affected","version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic"}],"defaultStatus":"unaffected"},{"vendor":"CODESYS","product":"OPC DA Server SL","versions":[{"status":"affected","version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic"}],"defaultStatus":"unaffected"},{"vendor":"CODESYS","product":"PLCHandler","versions":[{"status":"affected","version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic"}],"defaultStatus":"unaffected"},{"vendor":"CODESYS","product":"Runtime Toolkit","versions":[{"status":"affected","version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic"}],"defaultStatus":"unaffected"},{"vendor":"CODESYS","product":"Edge Gateway for Linux","versions":[{"status":"affected","version":"3.15.0.0","lessThan":"4.23.0.0","versionType":"generic"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T15:28:07.834Z","provider":"cve","references":["https://www.certvde.com/en/advisories/VDE-2026-094/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76992","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:48:15.816736Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:28:07.834Z"}}],"cna":{"orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","shortName":"CERTVDE","dateUpdated":"2026-09-30T11:07:45.751Z"}}},"related_cves":[{"value":"CVE-2026-76992","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":4525,"next_before":4525}