CVE-2021-34595

CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service

8.1 High

A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: High

Exploit likelihood

0.85%Up 0.4 points since Oct 27, 2021

What each source reports

CVE List Score used 8.1

CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service

Record: CVE-2021-34595
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-823
Updated: 2026-11-02

EUVDEUVD-2021-21245 8.1

Record: EUVD-2021-21245
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r36w-qc6c-g892 8.1

A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS...

Record: GHSA-r36w-qc6c-g892
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-119, CWE-823
Updated: 2026-11-02

NVD 8.1

Record: CVE-2021-34595
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0: 5.5 MediumAV:N/AC:L/Au:S/C:N/I:P/A:P
Weakness: CWE-823, CWE-119
Updated: 2026-11-02

Affected products

Show 19 moreShow less

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-34595 is a high vulnerability (CVSS 8.1) in Codesys, published October 26, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. No source names a fixed version.