Live › vulnerability › CVE-2026-111732
P-Net is an embedded PROFINET device stack. A crafted Connect request with an unchecked length field causes an out-of-bounds write into a fixed-size buffer, which can crash the device or potentially allow arbitrary code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Only builds of P-Net older than 1.0.3 compiled with PNET_OPTION_AR_VENDOR_BLOCKS enabled are exposed, since that option is disabled by default. The flaw is reached by a crafted Connect request from the network, so devices exposing PROFINET to untrusted networks are the priority. Systems that use the default configuration or do not run P-Net can skip it.
No product ranges from the sources yet.
1.0.3.PNET_OPTION_AR_VENDOR_BLOCKS (disabled by default).1.0.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution.
This option is disabled by default.
This page as .md · .json · in your agent: get_signal("CVE-2026-111732")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.