CVE-2026-111732
RT-Labs P-Net
- RT-Labs P-Net
- Critical
- CVSS 9.3
- Fixed version listed
Summary
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length.
From the CVE record.
Read the original description
CVE record
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution.
This option is disabled by default.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| RT-Labs P-Net | before 1.0.3 | 1.0.3 |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.3 (v4.0, scored by rt-labs)
- Weakness
- CWE-787: Out-of-bounds Write
- Vendor
- RT-Labs, P-Net
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.