Live › vulnerability › CVE-2026-115794
P-Net, an industrial PROFINET device stack, passes the application alarm callback a data length taken from an alarm frame without checking it against the received frame size. A crafted short frame can make the callback report up to 65507 bytes, so an application that copies that many bytes reads past its receive buffer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Only applications built on P-Net before 1.0.3 that use the alarm callback data are exposed; applications that ignore alarm data are not affected. The attacker must first establish an Application Relationship and be on the adjacent network, so the exposure sits on industrial control segments rather than the internet.
No product ranges from the sources yet.
unknown if the sources do not say how to read it, otherwise compare against the fixed version below.1.0.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-115794")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.