CVE-2026-111730: Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in getcheckpeer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution.
Requires establishment of session that needs ADJACENT network access.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Who is exposed to exploitation?
P-Net deployments running versions before 1.0.3 are affected. An attacker must have ADJACENT network access and establish a session with the target.
What can an attacker achieve?
A crafted CheckPeers block can write up to 15 bytes beyond the peer station name buffer. This can crash the affected system and may potentially allow arbitrary code execution.
What input triggers the overflow?
The vulnerable parser accepts an unvalidated LengthPeerStationName value of up to 255 bytes, while the destination peer station name buffer is 241 bytes. The copy operation and NUL terminator placement can therefore exceed the buffer boundary.