# CVE-2026-111734: P-Net Ethernet frame length validation vulnerability

Source: https://junglewise.ai/threats/cve-2026-111734-p-net-before-1-0-3-does-not-validate-the-length-of-a-received  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-111734 · Severity: info · Published 2026-10-29

P-Net is an industrial automation library that processes PROFINET network frames. Malformed Ethernet frames with excessive VLAN tags can cause the library to read past buffer boundaries, leading to application crashes or exposure of sensitive memory contents on systems using vulnerable versions.

Technologies: [RT-Labs P-Net](https://junglewise.ai/threats/technologies/p-net). Vendors: [RT-Labs](https://junglewise.ai/threats/vendors/rt-labs).

## Quick answers

**Is CVE-2026-111734 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111734 being exploited in the wild.

**How severe is CVE-2026-111734?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** RT-Labs P-Net before 1.0.3.

**Is there a fix for CVE-2026-111734?** Yes: fixed in P-Net 1.0.3 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111734 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111734?** Check whether you run RT-Labs P-Net at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in P-Net 1.0.3 and later

## Technical details

The pf_eth_recv() function does not validate the total length of received Ethernet frames before parsing EtherType, VLAN tags, and PROFINET FrameID fields. An unbounded loop processing VLAN tags allows a truncated frame or one consisting entirely of VLAN tags to cause an out-of-bounds read past the receive buffer, resulting in denial of service via crash or information disclosure.

## Affected products

- RT-Labs P-Net before 1.0.3

## Timeline

- 2026-10-29: disclosed

## References

- [https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf](https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf)

## Related threats

- [P-Net buffer over-read in DCP message processing](https://junglewise.ai/threats/cve-2026-115795-p-net-before-1-0-3-does-not-check-that-a-complete-block-header)
- [P-Net buffer over-read in RTA alarm callback](https://junglewise.ai/threats/cve-2026-115794-p-net-before-1-0-3-passes-the-application-alarm-callback-a-data)
- [P-Net RPC session leak leading to denial of service](https://junglewise.ai/threats/cve-2026-115793-p-net-before-1-0-3-does-not-release-the-rpc-session-allocated)
- [P-Net resource exhaustion via malformed RPC requests](https://junglewise.ai/threats/cve-2026-112200-p-net-before-1-0-3-does-not-release-the-application-relationship)
- [P-Net NULL pointer dereference in implicit read request handling](https://junglewise.ai/threats/cve-2026-111736-p-net-before-1-0-3-dereferences-a-null-ar-pointer-in-pf-fspm-cm)