TI-2026-82634 Aliases CVE-2026-115795 GHSA-8qv2-6w52-jhrq

Out-of-bounds read of DCP block header in DCP Set and Identify request parsing

LOW 23CWE-125Published 2026-10-29 · Updated 2026-11-05

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

RT-Labs P-Net before 1.0.3 does not check that a complete block header is present before reading the next block in DCP Set and Identify requests, which causes an out-of-bounds read (CWE-125). An adjacent network attacker without privileges can crash the device or read a small amount of memory contents.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In addition, a DCP Set block with a length smaller than the two-byte block qualifier makes the length underflow, so the block is processed with a length of 65534 bytes. This can cause a crash (denial of service) or disclose a small amount of memory content. Requires ADJACENT network access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00165 5th percentileScored 2026-11-07

Fix Fixed P-Net (RT-Labs): 1.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
RT-Labs	P-Net	before 1.0.3	1.0.3	Patch available	CNA

P-Net VendorRT-Labs Affected before 1.0.3 Fixed in 1.0.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:rt-labs:p-net::::::::	—	—	RT-Labs

cpe:2.3:a:rt-labs:p-net:*:*:*:*:*:*:*:* Versions — — ·RT-Labs

Remediation

Upgrade RT-Labs P-Net to version 1.0.3 or later, which is the fixed version listed for this product.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA P-Net (RT-Labs) Fixed in 1.0.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-29
RT-Labs P-Net 1.0.3
11 records Highest priority Priority MEDIUM 5 MEDIUM, 6 LOW
Other records, highest priority first
- TI-2026-82626 Out-of-bounds write when parsing AR Vendor Block requests in RT-Labs P-NetPriority MEDIUM 48
- TI-2026-82632 Resource exhaustion from RPC sessions kept for unknown interface requestsPriority MEDIUM 44
- TI-2026-82630 NULL pointer dereference in RT-Labs P-Net on implicit read requestsPriority MEDIUM 44
Show all 11 records →

Timeline

2026-10-29 Threatist record created from CVE-2026-115795
2026-10-29 Alias added: GHSA-8qv2-6w52-jhrq
2026-11-05 CISA SSVC decision points changed

References

Other 1

Cybersecurity advisory for P-Net

TI-2026-82626 Out-of-bounds write when parsing AR Vendor Block requests in RT-Labs P-Net CVSS 4.0CRITICAL 9.3
TI-2026-82632 Resource exhaustion from RPC sessions kept for unknown interface requests CVSS 4.0HIGH 8.7
TI-2026-82630 NULL pointer dereference in RT-Labs P-Net on implicit read requests CVSS 4.0HIGH 8.7
TI-2026-82627 NULL pointer dereference in P-Net lets remote attackers crash devices CVSS 4.0HIGH 8.7
TI-2026-82625 Infinite loop in RT-Labs P-Net PDPortDataCheck record handling CVSS 4.0HIGH 8.7
TI-2025-23482 Out-of-bounds write in RT-Labs P-Net CVSS 3.1CRITICAL 9.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences