CVE-2026-127122
Out-of-bounds write with too many MCR blocks in a Connect request
P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNET_MAX_MC_CR, 1 by default). Each further block is written past the end of the array, into the rest of the Application Relationship and, with more blocks, into the following one. The written data comes from the request. No established Application Relationship is needed, and the attacker requires ADJACENT network access. Builds with PNET_OPTION_MC_CR disabled are not affected.
Fixes and workarounds
Fix
Upgrade to P-Net 1.0.4 or later.
Source: CNA: rt-labsWorkaround
Build P-Net with PNET_OPTION_MC_CR disabled. Multicast communication relations are not supported by P-Net, and a Connect request with MCR blocks is then rejected.
Source: CNA: rt-labsAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| P-Net RT-Labs |
≥ 0; < 1.0.4 (affected, semver)
Other versions: unaffected |
CNA: rt-labs |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 7.2 high |
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N | CNA: rt-labs |
| 4.0 / 7.2 high |
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD: 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdfCNA: rt-labs
- https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf4b71179a-3b92-4a9d-b9fc-af8b8ed579ee
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.