{"id":"CVE-2026-115794","kind":"vulnerability","aliases":["CVE-2026-115794"],"related":[],"title":"P-Net: alarm frame length check missing, enabling out-of-bounds reads","description":"P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected.","summary":"P-Net, an industrial PROFINET device stack, passes the application alarm callback a data length taken from an alarm frame without checking it against the received frame size. A crafted short frame can make the callback report up to 65507 bytes, so an application that copies that many bytes reads past its receive buffer.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","industrial-control","p-net","package","profinet"],"not_affected_if":["alarm-data-unused","no-application-relationship","not-adjacent-network"],"how_to_check":"- Check the P-Net version in use: `unknown` if the sources do not say how to read it, otherwise compare against the fixed version below.\n- Look for an application that uses the P-Net alarm callback and copies the reported data length.","fix":"- P-Net: move to `1.0.3` or later.","status":"open","published_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:32:15+00:00","updated_at":"2026-10-29T16:32:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: move to `1.0.3` or later.","reach":"network","title":"P-Net: alarm frame length check missing, enabling out-of-bounds reads","impact":"low","summary":"P-Net, an industrial PROFINET device stack, passes the application alarm callback a data length taken from an alarm frame without checking it against the received frame size. A crafted short frame can make the callback report up to 65507 bytes, so an application that copies that many bytes reads past its receive buffer.","audience":"businesses","category":"package","nicknames":[],"who_cares":["p-net","profinet","industrial-control","embedded"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"out-of-bounds memory read from the device receive buffer","analyst_note":"","how_to_check":"- Check the P-Net version in use: `unknown` if the sources do not say how to read it, otherwise compare against the fixed version below.\n- Look for an application that uses the P-Net alarm callback and copies the reported data length.","plain_action":"","needs_analyst":false,"not_affected_if":["alarm-data-unused","not-adjacent-network","no-application-relationship"],"who_is_affected":"Only applications built on P-Net before 1.0.3 that use the alarm callback data are exposed; applications that ignore alarm data are not affected. The attacker must first establish an Application Relationship and be on the adjacent network, so the exposure sits on industrial control segments rather than the internet.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00069,"input_tokens":4171,"output_tokens":545,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115794':17A,20A '-2026':16A,19A '1.0.3':89C '65507':70B,134C 'access':165C 'adjac':163C 'affect':176C 'alarm':4A,41B,49B,93C,109C,172C 'applic':40B,74B,92C,137C,159C,166C 'attack':154C 'bound':13A 'buffer':84B,152C 'byte':71B,79B,135C,144C 'callback':42B,66B,94C,127C 'check':7A,52B,112C 'control':24B 'copi':76B,139C 'craft':60B 'cve':15A,18A 'data':44B,96C,173C 'deriv':98C 'devic':36B 'embed':21B 'enabl':9A 'end':148C 'establish':157C 'field':104C 'frame':5A,50B,57B,62B,110C,120C,123C 'industri':23B,34B 'industrial-control':22B 'length':6A,45B,97C,103C,116C,130C 'make':64B,125C 'mani':78B 'miss':8A 'must':155C 'net':3A,27B,32B,87C 'network':164C 'number':142C 'out-of-bound':10A 'p':2A,26B,31B,86C 'p-net':1A,25B,30B,85C 'packag':28B 'part':102C 'pass':38B,90C 'past':81B,146C 'profinet':29B,35B 'read':14A,80B,145C 'receiv':56B,83B,107C,119C,128C,151C 'relationship':160C 'report':67B,141C 'requir':162C 'rta':108C 'short':61B,122C 'size':58B 'stack':37B 'taken':46B 'use':170C 'variabl':101C 'without':51B,111C","nicknames":[],"mitigations":[],"who_affected":"Only applications built on P-Net before 1.0.3 that use the alarm callback data are exposed; applications that ignore alarm data are not affected. The attacker must first establish an Application Relationship and be on the adjacent network, so the exposure sits on industrial control segments rather than the internet.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115794","severity":null,"published_at":"2026-10-29T16:17:58+00:00","modified_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}