RT-Labs has 11 CVEs on record. Disclosure cadence is accelerating: 11 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 11. The median CVSS is 8.7 (high), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-125 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.7
- Publish → KEV
- —
- Last 90 days
- 11 prev 0
Worst active — by depth score
CVE-2026-111732Critical· 9.3Out-of-bounds write when parsing AR Vendor Block requests51CVE-2026-115793High· 8.7Resource exhaustion from RPC sessions kept for requests to unknown interface48CVE-2026-112200High· 8.7Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness48CVE-2026-111736High· 8.7NULL pointer dereference on implicit read of user specific record index48CVE-2026-111733High· 8.7NULL pointer dereference on implicit read of AR specific record index48
RT-Labs vulnerabilities
CVEs affecting RT-Labs, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-115793High· 8.7Resource exhaustion from RPC sessions kept for requests to unknown interface
P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available s…
CVE-2026-115794Low· 2.3Alarm data length not validated against received frame length
P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the cal…
CVE-2026-115795Medium· 5.3Out-of-bounds read of DCP block header in DCP Set and Identify request parsing
P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of t…
CVE-2026-111735High· 7.1Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 us…
CVE-2026-112200High· 8.7Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requ…
CVE-2026-111736High· 8.7NULL pointer dereference on implicit read of user specific record index
P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remot…
CVE-2026-111734High· 7.1Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame co…
CVE-2026-111733High· 8.7NULL pointer dereference on implicit read of AR specific record index
P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a …
CVE-2026-111732Critical· 9.3Out-of-bounds write when parsing AR Vendor Block requests
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-siz…
CVE-2026-111731High· 8.7Infinite loop when reading PDPortDataCheck record of subslot 0
P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device …
CVE-2026-111730High· 7.2Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating…