CVE-2023-22421

Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. The insufficient buffer size for the PLC program instructions leads to out-of-bounds read. As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution.

• CWE-125
• CWE-125

• https://jvn.jp/en/vu/JVNVU94966432/Third Party Advisory
• https://www.electronics.jtekt.co.jp/en/topics/202303035258/Vendor Advisory
• https://www.electronics.jtekt.co.jp/jp/topics/2023030313639/Vendor Advisory
• https://jvn.jp/en/vu/JVNVU94966432/Third Party Advisory
• https://www.electronics.jtekt.co.jp/en/topics/202303035258/Vendor Advisory
• https://www.electronics.jtekt.co.jp/jp/topics/2023030313639/Vendor Advisory

Published

Mar 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22415An Out-of-Bounds Write vulnerability in the H.323 ALG of Jun…7.5
• CVE-2023-22416A Buffer Overflow vulnerability in SIP ALG of Juniper Networ…7.5
• CVE-2023-22417A Missing Release of Memory after Effective Lifetime vulnera…7.5
• CVE-2023-22418On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, …6.1
• CVE-2023-22419Out-of-bounds read vulnerability exists in Kostac PLC Progra…7.8
• CVE-2023-2242A vulnerability has been found in SourceCodester Online Comp…8.8
• CVE-2023-22422On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before …7.5
• CVE-2023-22424Use-after-free vulnerability exists in Kostac PLC Programmin…7.8
• CVE-2023-22425Stored cross-site scripting vulnerability in Schedule functi…5.4
• CVE-2023-22427Stored cross-site scripting vulnerability in Theme switching…4.8
• CVE-2023-22428 Improper privilege validation in Command Centre Server allo…6.5
• CVE-2023-22429Android App 'Wolt Delivery: Food and more' version 4.27.2 an…7.8