PT-2026-146838

CVE-2026-124758

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

2.3

Low

MetricsAV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access.

Exploitability

Fix

Impacts

Researchers

3Ntr0Py1337

Khalilov M

Vendors

Affected products

Weakness enumeration

CWE-191: Integer Underflow (Wrap or Wraparound)

Related identifiers

CVE-2026-124758