CVE-2026-111732Critical· 9.3▾ MidnightP-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-siz…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Last analysed / modified upstream
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution.
This option is disabled by default.
P-Net < 1.0.3Upgrade to P-Net 1.0.3 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111730High· 7.2Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
CVE-2026-115793High· 8.7Resource exhaustion from RPC sessions kept for requests to unknown interface
CVE-2026-115794Low· 2.3Alarm data length not validated against received frame length
CVE-2026-115795Medium· 5.3Out-of-bounds read of DCP block header in DCP Set and Identify request parsing
CVE-2026-111735High· 7.1Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
CVE-2026-112200High· 8.7Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness