PatchSiren cyber security CVE debrief

CVE-2022-32142 CODESYS CVE debrief

CVE-2022-32142 is a high-severity memory-corruption issue in CODESYS products as packaged with Festo Automation Suite. A low-privileged remote attacker can send a request with an invalid offset and trigger an out-of-bounds read or write, which can lead to denial of service or local memory overwrite. The advisory states that no user interaction is required and recommends moving to patched CODESYS builds from the vendor and keeping Festo Automation Suite up to date.

Vendor: CODESYS
Product: FESTO
CVSS: HIGH 8.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-02-26
Original CVE updated: 2026-03-17
Advisory published: 2026-02-26
Advisory updated: 2026-03-17

Who should care

OT/ICS teams using Festo Automation Suite, engineering workstations that include CODESYS components, plant administrators, patch-management teams, and incident responders supporting industrial automation environments.

Technical summary

The source advisory describes an invalid-offset handling flaw in multiple CODESYS product combinations distributed with Festo Automation Suite. The issue can cause out-of-bounds read or write access from a low-privileged remote request. Likely outcomes include service disruption and memory corruption, with the advisory also noting the possibility of local file changes. The advisory’s remediation guidance centers on using patched CODESYS from the official vendor and updating Festo Automation Suite as released.

Defensive priority

High. Prioritize inventorying Festo Automation Suite/CODESYS installations, verifying versions, and applying vendor updates because the issue is remotely reachable, requires only low privileges, and can affect availability and integrity.

Recommended defensive actions

Inventory all Festo Automation Suite installations and identify any bundled CODESYS components.
Check whether affected bundle combinations or versions listed in the advisory are present, especially installations below Festo Automation Suite 2.8.0.138.
Apply the latest patched CODESYS release from the official CODESYS website and follow the vendor’s installation/update instructions.
Update Festo Automation Suite with the latest connector or suite releases published by Festo.
Monitor CODESYS and Festo security advisories for follow-on fixes or version guidance.
Treat unexplained crashes or file-integrity changes on affected engineering systems as potential indicators of exploitation and investigate promptly.

Evidence notes

This debrief is based on CISA CSAF advisory ICSA-26-076-01, which republishes Festo SE & Co. KG advisory FSA-202601 for CVE-2022-32142. The source describes multiple affected Festo Automation Suite/CODESYS bundle combinations, states that user interaction is not required, and recommends obtaining patched CODESYS directly from the official vendor while keeping Festo updates current. The CVE and source advisory were published on 2026-02-26 and republished/modified by CISA on 2026-03-17.

Sources and references

Verified primary and authoritative sources

CVE-2022-32142 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2022-32142

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2022-32142 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-32142

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

Reference
Source reference
Unverified legacy reference

URL: https://certvde.com/en/advisories/vendor/festo/

Reference
Source reference
Unverified legacy reference

URL: https://www.festo.com/psirt

Reference
Source reference
Unverified legacy reference

URL: https://certvde.com/en/advisories/VDE-2025-108

Reference
Source reference
Unverified legacy reference

URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.