CVE-2026-111735 in P-Net
Summary
by MITRE • 10/29/2026
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in P-Net versions prior to 1.0.3 represents a critical integer underflow flaw located within the pf_cpm_c_data_ind() function, which is responsible for processing received cyclic data frames from application partners. This component operates during specific operational states of the consumer device, namely FRUN and RUN, where it actively handles incoming network traffic. The core technical defect arises from an incorrect arithmetic operation used to determine the offset for accessing APDU status information within the frame structure. Specifically, the function calculates this offset by subtracting four bytes from the total frame length using 16-bit unsigned integer arithmetic. This calculation assumes that all received frames meet a minimum size requirement of at least four bytes, which is necessary to safely accommodate the header and control data without accessing invalid memory regions.
When an attacker or malicious actor sends a crafted short frame with a length value less than four bytes, the subtraction operation results in an integer underflow due to the wrap-around behavior inherent to unsigned 16-bit arithmetic. For instance, if a frame is reported as having zero length, subtracting four yields a large positive offset close to sixty-five thousand five hundred thirty-five. This erroneous offset directs subsequent memory read operations far beyond the boundaries of the allocated receive buffer. Consequently, the application attempts to access memory locations that are not part of the intended data structure, leading to undefined behavior within the software execution context.
The operational impact of this vulnerability is severe and primarily manifests as a denial of service condition or potential information disclosure. In most scenarios, accessing out-of-bounds memory triggers an immediate segmentation fault or similar critical error, causing the P-Net consumer application to crash abruptly. This disrupts industrial automation processes that rely on continuous cyclic data exchange, potentially leading to production halts or safety risks in connected systems. Furthermore, depending on how the operating system handles such illegal memory accesses and whether side-channel effects are exploitable, there is a theoretical risk of disclosing sensitive memory contents from adjacent buffers or kernel space, which could aid further exploitation attempts against the host system.
This flaw aligns with Common Weakness Enumeration (CWE) identifiers for integer underflow vulnerabilities that lead to out-of-bounds reads, specifically CWE-192 and CWE-787 respectively. From a tactical perspective related to the MITRE ATT&CK framework, this vulnerability facilitates initial access or disruption through exploitation of input validation failures in network-facing services, categorized under techniques involving resource exhaustion or data exfiltration via memory corruption. To mitigate this risk, organizations must upgrade P-Net implementations to version 1.0.3 or later where the arithmetic check has been corrected to validate frame lengths before performing subtraction operations. Additionally, implementing strict input validation at the network interface level and deploying intrusion detection systems capable of identifying anomalous packet sizes can provide an additional layer of defense against exploitation attempts targeting this specific logic error in industrial control environments.