---
id: "CVE-2026-115794"
kind: "vulnerability"
aliases: ["CVE-2026-115794"]
title: "P-Net: alarm frame length check missing, enabling out-of-bounds reads"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded", "industrial-control", "p-net", "package", "profinet"]
not_affected_if: ["alarm-data-unused", "no-application-relationship", "not-adjacent-network"]
published_at: "2026-10-29T16:17:58+00:00"
first_seen_at: "2026-10-29T16:25:56+00:00"
updated_at: "2026-10-29T16:32:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115794", "first_seen_at": "2026-10-29T16:25:56+00:00"}]
---

# P-Net: alarm frame length check missing, enabling out-of-bounds reads

P-Net, an industrial PROFINET device stack, passes the application alarm callback a data length taken from an alarm frame without checking it against the received frame size. A crafted short frame can make the callback report up to 65507 bytes, so an application that copies that many bytes reads past its receive buffer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the P-Net version in use: `unknown` if the sources do not say how to read it, otherwise compare against the fixed version below.
- Look for an application that uses the P-Net alarm callback and copies the reported data length.

## Fix

- P-Net: move to `1.0.3` or later.

## Timeline

- 2026-10-29T16:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115794

## From the sources

P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_