P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade to P-Net 1.0.3 or later.
Workaround
No workaround given by the vendor.
References
History
Thu, 29 Oct 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected. | |
| Title | Alarm data length not validated against received frame length | |
| Weaknesses | CWE-130 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: rt-labs
Published:
Updated: 2026-10-29T15:43:55.798Z
Reserved: 2026-10-23T14:31:00.895Z
Link: CVE-2026-115794
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-10-29T16:17:58.987
Modified: 2026-10-29T16:26:50.750
Link: CVE-2026-115794
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses