CVE-2026-111732

P-Net before 1.0.3, when built with PNETOPTIONARVENDORBLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block...

EUVD-2026-113006

P-Net before 1.0.3, when built with PNETOPTIONARVENDORBLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block...