What’s Vulnerable › Vulnerabilities
CVE-2026-111732: Out-of-bounds write when parsing AR Vendor Block requests
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-29 · updated 2026-10-29
- Weakness: CWE-787
Description
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution. This option is disabled by default.
Summary
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, trusts a data length field in AR Vendor Block requests that is outside the block definition and copies that many bytes into a fixed-size buffer without bounds checking. A crafted Connect request triggers an out-of-bounds write, causing a crash (denial of service) or potentially arbitrary code execution; CVSS is 9.3 critical. The option is disabled by default, so only builds that explicitly enable it are exposed. No exploitation in CISA KEV is reported; upgrade to P-Net 1.0.3, and in the meantime avoid enabling PNET_OPTION_AR_VENDOR_BLOCKS.
توجد ثغرة في P-Net قبل الإصدار 1.0.3 عندما يُبنى مع تفعيل PNET_OPTION_AR_VENDOR_BLOCKS، إذ يقرأ طول البيانات من حقل في طلبات AR Vendor Block لا ينتمي إلى تعريف الكتلة ويستخدمه لنسخ عدد من البايتات إلى مخزن ثابت الحجم دون التحقق من حجم المخزن أو طول الكتلة. يؤدي طلب Connect مُصمَّم بعناية إلى كتابة خارج الحدود، ما قد يسبب انهيارًا (حجب الخدمة) أو احتمال تنفيذ تعليمات برمجية عشوائية، بدرجة خطورة 9.3 (حرجة). الخيار معطّل افتراضيًا، لذا لا تتأثر إلا النسخ التي تُبنى مع تفعيله صراحةً. لا يُبلَّغ عن استغلال ضمن CISA KEV؛ يُنصح بالترقية إلى P-Net 1.0.3، وبتجنب تفعيل PNET_OPTION_AR_VENDOR_BLOCKS إلى حين ذلك.
Affected products
- RT-Labs P-Net: before 1.0.3 — fixed in 1.0.3
How to fix
Upgrade to a fixed version: RT-Labs P-Net 1.0.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-111732 or the next vulnerability affects your stack