CVE-2026-124758
Integer underflow of the record data length in IODWrite requests
Description
P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access.
INFO
Published Date :
Nov. 13, 2026, 1:23 p.m.
Last Modified :
Nov. 13, 2026, 1:23 p.m.
Remotely Exploit :
No
Source :
rt-labs
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | LOW | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee |
Solution
- Update P-Net to version 1.0.4 or later.
- Ensure record data length is validated.
- Validate record block header sizes.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-124758 vulnerability anywhere in the article.