Vulnerability · Published Oct 29, 2026 · Assigned by rt-labs

CVE-2026-111734Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()

High 7.1

In plain English

A high-severity out-of-bounds read in P-Net from RT-Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 94.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content.

Affected products (as reported)

Vendor	Product	Versions
RT-Labs	P-Net	0 – before 1.0.3

Weakness: CWE-125 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

References

Cybersecurity advisory for P-Net