Skip to content
OpenAdvisories
High · 7.2 CVE-2026-111730 EUVD-2026-113004GHSA-w9g9-93r6-xxcf

Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length

Published Oct 29, 2026 · Updated Nov 5, 2026 · Assigned by rt-labs

Description

P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution.

Requires establishment of session that needs ADJACENT network access.

Affected products

VendorProductAffectedFixed
RT-Labs P-Net < 1.0.3 1.0.3

References