CVE-2026-111734

P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pfethrecv before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end...

CVE-2026-111734

P-Net versions prior to 1.0.3 are vulnerable to an out-of-bounds read within the pf_eth_recv() function. The software fails to validate the length of received Ethernet frames before processing the EtherType, VLAN tags, and PROFINET FrameID. Because the VLAN tag loop lacks an upper bound, processi...

EUVD-2026-113008

P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pfethrecv before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end...