CVE-2026-115794

The record

P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected.

Affected packages

Related vulnerabilities

• CVE-2026-119600 tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows… CWE-130
• CVE-2026-119279 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-119277 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked… CWE-130
• CVE-2026-114597 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length… CWE-130
• CVE-2026-116013 OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability… CWE-130
• CVE-2026-114646 A data-validation flaw exists in the BSON handling and binary serialization path of the… CWE-130