CVE-2026-111730 Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-111730?
CVE-2026-111730 is a high-severity vulnerability in RT-Labs P-Net, published on 29 Oct 2026.
Official description
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution.
Requires establishment of session that needs ADJACENT network access.
Weakness: CWE-787
Which versions are affected by CVE-2026-111730?
How do I fix CVE-2026-111730?
No fix has been published for CVE-2026-111730 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111730 being exploited?
There is no known exploitation of CVE-2026-111730 in the wild and no public exploit code.
Sources
Also known as GHSA-w9g9-93r6-xxcf.