Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
Impact
P-Net before 1.0.3 has an out-of-bounds write vulnerability due to unvalidated peer station name length in the CheckPeers block parser, potentially leading to a crash or arbitrary code execution, requiring adjacent network access to establish a session. The weakness is in the get_check_peer() function.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Requires establishment of session that needs ADJACENT network access.
What to do
Upgrade to P-Net 1.0.3 or later.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
RT-Labs · rt-labs
P-Net
1 range
RT-Labs · rt-labs
P-Net
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 1.0.3
semver versions
Other versions: unaffected
Original source description
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution.
Requires establishment of session that needs ADJACENT network access.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-111730View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.