CVE-2026-111730
Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution. Requires establishment of session that needs ADJACENT network access.
| CWE | CWE-787 |
| Vendor | rt-labs |
| Product | p-net |
| Published | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for rt-labs p-net
Be the first to know when new unknown vulnerabilities affecting rt-labs p-net are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
RT-Labs / P-Net
0 < 1.0.3
References
Credits
Brian Willows f0rw4rd (quellsec.dev)