CVE-2025-14673 is a high severity heap based buffer overflow (CVSS 7.3) in gmg137 snap7-rs, versions up to and including 1.142.1. The record lists no fixed version. Find out whether your projects depend on the library, then check the project's issue tracker for a patch before you update.
What's affected
The record names gmg137 snap7-rs, up to 1.142.1. The vulnerable function is snap7_rs::client::S7Client::as_ct_write, in a file under the path /tests/snap7-rs/src/client.rs. The record describes the result as a heap based buffer overflow.
One point worth noting: the file path in the record contains tests. Whether that means test code only or a path used in release builds is not stated. Look at what your own build actually compiles before you decide how exposed you are.
- Severity: High, CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Network reachable, no privileges, no user interaction, according to the vector.
- Impact is scored low for confidentiality, integrity and availability.
- Fixed version: none stated in the record.
- Exploitation in the wild: not in CISA KEV. The record says the exploit has been published.
The project's own issue (ID2H74 on Gitee) is linked from the record. This post does not reproduce its details.
How to check if you're exposed
The library name suggests a Rust crate that wraps the Snap7 library for talking to Siemens S7 devices. The record itself does not say so, so confirm the name in your own lock files.
# In a Rust project
grep -n "snap7" Cargo.lock
cargo tree -i snap7-rs
# Across many repositories
grep -rn "snap7" --include=Cargo.toml --include=Cargo.lock .
If the crate shows up, note the version. Anything at or below 1.142.1 is in the range the record names.
You can also run the free in-browser dependency scan on a lock file to see known CVEs matched to your dependencies. Reachability analysis then helps you separate projects that call the affected code from projects that only carry the crate.
What to do now
- Search all repositories and build images for the crate, and record each version.
- Open the project's issue and its repository to see whether a fix or a newer release exists. The record lists none.
- If your code talks to industrial devices, keep that traffic on an isolated network segment, away from untrusted hosts.
- Do not expose services built on this library to the internet.
- If you must keep using it, pin the version and add a review item for the next release.
- Consider whether another library or a vendor supported client meets your need.
Why it matters
The class is CWE-122, heap based buffer overflow, a child of CWE-119, improper restriction of operations within the bounds of a memory buffer. Memory safety bugs in native code can crash a process, corrupt data or, in the worst cases, change program behavior. Rust protects well against these inside safe Rust, but a wrapper around C++ code brings the C++ failure modes back.
That is why a Rust label on a dependency is not the whole story. Check what the crate links against. Libraries that talk to industrial equipment also tend to run in places where an outage or bad write has physical consequences, so even a low confidentiality score deserves care.
Quick check
Is there a fixed snap7-rs release?
The record does not list one. Check the project's repository and the Gitee issue linked from the record before you decide to upgrade or replace the crate.
Why does reachability matter here?
A buffer overflow in a function only matters if your code can reach it. Reachability analysis tells you whether your call paths touch the affected function, which helps you order the work.
Sources
Last reviewed: 19 October 2026.
