Threats tagged 'ghsa-h967-v272-9m8r'

P-Net versions before 1.0.3, when compiled with the PNET_OPTION_AR_VENDOR_BLOCKS option enabled, contain a vulnerability where a data length is parsed from a field in the ARVendorBlock request that is not part of the block definition. This length is used to copy bytes into a fixed-size buffer without proper bounds checking, leading to an out-of-bounds write. This flaw can cause a crash resulting in denial of service or potentially allow arbitrary code execution. The vulnerable option is disabled by default.