Vulnerability · Published Oct 29, 2026 · Assigned by rt-labs

CVE-2026-111735Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()

High 7.1

In plain English

A high-severity out-of-bounds read in P-Net from RT-Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 94.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content.

Affected products (as reported)

Vendor	Product	Versions
RT-Labs	P-Net	0 – before 1.0.3

Weakness: CWE-191, CWE-125 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

References

Cybersecurity advisory for P-Net