High severity · published Oct 29, 2026
CVE-2026-111735
Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
New
7.1
CVSS
–
EPSS
No
On KEV
Description
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PN
P-Net · RT-Labs
before 1.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111735
rt-labs.com
https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf
More from P-Net
9.8
CVE-2025-32404
An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the library by sending a malicious RPC packet
9.8
CVE-2025-32403
An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the library by sending a malicious RPC packet
9.8
CVE-2025-32401
An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the library by sending a malicious RPC…
9.3
CVE-2026-111732
Out-of-bounds write when parsing AR Vendor Block requests
8.7
CVE-2026-115793
Resource exhaustion from RPC sessions kept for requests to unknown interface