CVE-2026-115794: Alarm data length not validated against received frame length
P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Which deployments are actually exposed?
Deployments using P-Net before 1.0.3 are exposed only if their application uses alarm data supplied through the application alarm callback. Applications that do not use alarm data are not affected.
What does an attacker need to exploit this issue?
The attacker needs ADJACENT network access and must first establish an Application Relationship. They can then send a short RTA alarm frame whose variable part length causes an inflated length to be reported to the callback.
What is the practical impact on an affected application?
If the application copies the reported alarm-data length, it can read beyond the end of the receive buffer. The reported length can be as large as 65,507 bytes.
What can be done if upgrading is not immediately possible?
Ensure application alarm callbacks do not copy or otherwise consume alarm data using the reported length unless that length has been validated against the actual received frame or buffer length. Limiting adjacent-network access also reduces exposure.