{"id":"CVE-2026-111734","published":"2026-10-29T16:17:57.717","lastModified":"2026-10-29T16:26:37.430","description":"P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}