CVE-2026-111736: NULL pointer dereference on implicit read of user specific record index
P-Net before 1.0.3 dereferences a NULL AR pointer in pffspmcmreadind() when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the device (denial of service).
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
P-Net versions before 1.0.3 are affected when the application has registered a read callback. The affected request path involves an implicit read of a user-specific record index.
Does an attacker need credentials or user interaction to trigger the crash?
No. A remote unauthenticated attacker can send a crafted implicit read request without a valid target AR UUID and crash the device.
What is the impact of successful exploitation?
Successful exploitation causes a NULL pointer dereference in pf_fspm_cm_read_ind(), crashing the device and resulting in denial of service.