{"id":"CVE-2026-111732","kind":"vulnerability","aliases":["CVE-2026-111732"],"related":[],"title":"P-Net: crafted Connect request overflows buffer, enabling crash or code execution","description":"P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution.\n\n\n\nThis option is disabled by default.","summary":"P-Net is an embedded PROFINET device stack. A crafted Connect request with an unchecked length field causes an out-of-bounds write into a fixed-size buffer, which can crash the device or potentially allow arbitrary code execution.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","industrial-control","p-net","package","profinet"],"not_affected_if":["default-config","p-net-1.0.3-or-later"],"how_to_check":"- Check whether the P-Net version is below `1.0.3`.\n- Check whether the build defines `PNET_OPTION_AR_VENDOR_BLOCKS` (disabled by default).","fix":"- Move P-Net to `1.0.3` or later.","status":"open","published_at":"2026-10-29T16:17:57+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:27:44+00:00","updated_at":"2026-10-29T16:27:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:27:44Z","model":"claude-haiku-5-5","output":{"fix":"- Move P-Net to `1.0.3` or later.","reach":"network","title":"P-Net: crafted Connect request overflows buffer, enabling crash or code execution","impact":"high","summary":"P-Net is an embedded PROFINET device stack. A crafted Connect request with an unchecked length field causes an out-of-bounds write into a fixed-size buffer, which can crash the device or potentially allow arbitrary code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["p-net","profinet","embedded","industrial-control"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Remote code execution on the device, or a crash that stops it","analyst_note":"Confirm the affected build flag and whether the 1.0.3 release notes or NVD entry state any workaround beyond upgrading.","how_to_check":"- Check whether the P-Net version is below `1.0.3`.\n- Check whether the build defines `PNET_OPTION_AR_VENDOR_BLOCKS` (disabled by default).","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","p-net-1.0.3-or-later"],"who_is_affected":"Only builds of P-Net older than 1.0.3 compiled with PNET_OPTION_AR_VENDOR_BLOCKS enabled are exposed, since that option is disabled by default. The flaw is reached by a crafted Connect request from the network, so devices exposing PROFINET to untrusted networks are the priority. Systems that use the default configuration or do not run P-Net can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000718,"input_tokens":4211,"output_tokens":593,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111732':16A,19A '-2026':15A,18A '1.0.3':75C 'allow':67B 'ar':81C 'arbitrari':68B,153C 'arvendorblock':94C 'block':83C,102C,129C 'bound':52B,140C 'buffer':8A,59B,119C,125C 'built':77C 'byte':111C 'caus':47B,135C 'code':12A,69B,154C 'compar':121C 'connect':5A,40B,133C 'control':23B 'copi':113C 'craft':4A,39B,132C 'crash':10A,62B,147C 'cve':14A,17A 'data':87C 'default':161C 'definit':103C 'denial':148C 'devic':36B,64B 'disabl':159C 'embed':20B,34B 'enabl':9A,84C 'execut':13A,70B,155C 'field':46B,91C 'fix':57B,117C 'fixed-s':56B,116C 'industri':22B 'industrial-control':21B 'lead':144C 'length':45B,88C,130C 'net':3A,26B,31B,73C 'number':109C 'option':80C,157C 'out-of-bound':49B,137C 'overflow':7A 'p':2A,25B,30B,72C 'p-net':1A,24B,29B,71C 'packag':27B 'pars':85C 'part':99C 'pnet':79C 'potenti':66B,152C 'profinet':28B,35B 'request':6A,41B,95C,134C 'servic':150C 'size':58B,118C,126C 'stack':37B 'uncheck':44B 'use':105C 'vendor':82C 'without':120C 'write':53B,141C","nicknames":[],"mitigations":[],"who_affected":"Only builds of P-Net older than 1.0.3 compiled with PNET_OPTION_AR_VENDOR_BLOCKS enabled are exposed, since that option is disabled by default. The flaw is reached by a crafted Connect request from the network, so devices exposing PROFINET to untrusted networks are the priority. Systems that use the default configuration or do not run P-Net can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111732","severity":null,"published_at":"2026-10-29T16:17:57+00:00","modified_at":"2026-10-29T16:17:57+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}