P-Net Vulnerability Allows Memory Disclosure and Denial of Service

CVE-2026-111734

What is CVE-2026-111734?

The P-Net application, prior to version 1.0.3, suffers from a vulnerability due to improper validation of Ethernet frame length during packet reception. Specifically, in the pf_eth_recv() function, lack of checks on the received frame length allows for the possibility of processing truncated frames or frames that consist entirely of VLAN tags. This oversight can lead to the function reading beyond the end of the designated receive buffer, which may trigger a denial of service attack or enable memory content disclosure. It is crucial for users to update their P-Net versions to prevent potential exploitation.

References