CVE-2026-127122: Out-of-bounds write with too many MCR blocks in a Connect request
P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNETMAXMCCR, 1 by default). Each further block is written past the end of the array, into the rest of the Application Relationship and, with more blocks, into the following one. The written data comes from the request. No established Application Relationship is needed, and the attacker requires ADJACENT network access. Builds with PNETOPTIONMCCR disabled are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.4
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
P-Net versions before 1.0.4 are affected when built with multicast communication-relation support enabled. Builds with PNET_OPTION_MC_CR disabled are not affected; PNET_MAX_MC_CR is 1 by default.
What does an attacker need to exploit it?
An attacker needs adjacent-network access and must send a Connect request containing more MCR request blocks than the Application Relationship can hold. No established Application Relationship is required, and no privileges or user interaction are required.
What can be done if updating is not immediately possible?
Build P-Net with PNET_OPTION_MC_CR disabled if multicast communication relations are not needed. Limiting access from adjacent networks to systems accepting Connect requests also reduces exposure.