CVE-2026-111732
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from…
- Risk score
- 61/100
- CVSS
- 9.3 v4.0
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.0.3 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.3 critical
- Remotely exploitable without logging in
References
Original description
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution. This option is disabled by default.
Last activity 29 Oct 2026. Patch Forecast updates every hour.