CVE-2026-124758: Integer underflow of the record data length in IODWrite requests
P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using P-Net versions before 1.0.4 are affected when they process IODWrite requests to non-user record indexes. Exploitation requires adjacent-network access and an established Application Relationship, or the ability to send requests in the context of one.
What is the practical impact of a successful exploit?
A malformed IODWrite request with a record data length smaller than the record block header can cause the I&M and PDPort handlers to read beyond the session buffer. The disclosed impact is limited to availability; the write result is discarded.
What request condition triggers the underflow?
The record data length must be smaller than the record block header size on an IODWrite request targeting a non-user record index. Subtracting the header size from the 32-bit length causes it to underflow, passing a length of about 65530 to record handlers.