CVE-2025-41739
published 2025-12-01CVE-2025-41739: An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux…
medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codesys | codesys_control_for_beaglebone_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_control_for_empc-a_imx6_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_control_for_iot2000_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_control_for_linux_arm_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_control_for_linux_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_control_for_pfc100_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_control_for_pfc200_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_control_for_plcnext_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_control_for_raspberry_pi_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_control_for_wago_touch_panels_600_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_edge_gateway_for_linux | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_plchandler | >= 3.5.21.0 < 3.5.21.40 | 3.5.21.40 |
| codesys | codesys_remote_target_visu | >= 3.5.21.0 < 3.5.21.40 | 3.5.21.40 |
| codesys | codesys_runtime_toolkit | >= 3.5.21.0 < 3.5.21.40 | 3.5.21.40 |
| codesys | codesys_targetvisu_for_linux_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |
| codesys | codesys_virtual_control_sl | >= 4.15.0.0 < 4.19.0.0 | 4.19.0.0 |