CVE-2026-25569
Published: 10 March 2026
Summary
CVE-2026-25569 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Siemens Sicam Siapp Sdk. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-25569 is an out-of-bounds write vulnerability (CWE-787) in the SICAM SIAPP SDK, affecting all versions prior to V2.1.7. This flaw allows an attacker to write data beyond the intended buffer boundaries within the SDK, which is a software development kit used in Siemens industrial control systems.
Exploitation requires local access (AV:L) with high attack complexity (AC:H) and no privileges (PR:N) or user interaction (UI:N), resulting in no scope change (S:U) but high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), for an overall CVSS v3.1 score of 7.4. A successful attacker could achieve denial of service or arbitrary code execution.
Siemens security advisory SSA-903736, available at https://cert-portal.siemens.com/productcert/html/ssa-903736.html, details the vulnerability and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10524
Vulnerability details
A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). An out-of-bounds write vulnerability exists in SICAM SIAPP SDK. This could allow an attacker to write data beyond the intended buffer, potentially leading to denial of service,…
more
or arbitrary code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local out-of-bounds write enables arbitrary code execution (T1068 Exploitation for Privilege Escalation) or application DoS (T1499.004 Application or System Exploitation) when attacker-supplied input reaches the vulnerable SDK code path.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Memory protection mechanisms (e.g., ASLR, DEP, stack canaries) directly block exploitation of the out-of-bounds write in the SICAM SIAPP SDK before arbitrary code execution or DoS can occur.
Strict input validation at SDK interfaces prevents malformed data from triggering the CWE-787 out-of-bounds write condition.
Flaw remediation requires prompt application of the vendor fix (upgrade to V2.1.7) that eliminates the vulnerable out-of-bounds write code path.