---
id: "CVE-2026-127122"
page: "https://infrastack.ai/live/CVE-2026-127122"
kind: "vulnerability"
aliases: ["CVE-2026-127122"]
title: "P-Net: unchecked multicast request blocks overflow memory on Profinet devices"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded", "industrial-control", "p-net", "package", "profinet"]
not_affected_if: ["non-adjacent-network", "pnet-1.0.4-or-later", "pnet-option-mc-cr-disabled"]
published_at: "2026-11-13T14:17:54+00:00"
first_seen_at: "2026-11-13T15:19:49+00:00"
updated_at: "2026-11-13T15:21:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127122", "first_seen_at": "2026-11-13T15:19:49+00:00"}]
exploit_sources: []
---

# P-Net: unchecked multicast request blocks overflow memory on Profinet devices

Link for people: https://infrastack.ai/live/CVE-2026-127122 (this .md is for agents)

P-Net is an open-source Profinet device stack used in industrial controllers. A Connect request with more multicast communication relation blocks than the array holds writes past the array end, letting a nearby attacker corrupt adjacent memory with request-supplied data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the P-Net version in the build: fewer than `1.0.4` is affected.
- Check whether the build defines `PNET_OPTION_MC_CR`; builds with it disabled are not affected.
- Check whether `PNET_MAX_MC_CR` is set, since the default is `1`.

## Fix

- P-Net: move to `1.0.4` or later.

## Timeline

- 2026-11-13T15:19:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127122

## From the sources

P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNET_MAX_MC_CR, 1 by default). Each further block is written past the end of the array, into the rest of the Application Relationship and, with more blocks, into the following one. The written data comes from the request. No established Application Relationship is needed, and the attacker requires ADJACENT network access. Builds with PNET_OPTION_MC_CR disabled are not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_