CVE-2026-127125
NULL pointer dereference when a response fragment is not acknowledged
P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relationship that is sent on another activity than its Connect, and gets a fragmented response, is handled on a session without one. If the response is not acknowledged, a NULL pointer is dereferenced and the device crashes. A conformant IO-controller does not send such requests. The attacker must have observed the AR UUID of an established Application Relationship and requires ADJACENT network access.
| CWE | CWE-476 |
| Vendor | rt-labs |
| Product | p-net |
| Published | Nov 13, 2026 |
Get instant alerts for rt-labs p-net
Be the first to know when new unknown vulnerabilities affecting rt-labs p-net are published — delivered to Slack, Telegram or Discord.