CVE-2022-32138: Codesys Plcwinnt

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite.

Affected products

• Codesys Plcwinnt: from 2.0, before 2.4.7.57 (fixed in 2.4.7.57)
• Codesys Runtime Toolkit: from 2.0, before 2.4.7.57 (fixed in 2.4.7.57)

Published 2022-06-24. Last modified 2026-06-17.