P-Net versions prior to 1.0.3 contain an integer underflow vulnerability in the function pf_cpm_c_data_ind(). This flaw occurs when processing a received cyclic data frame while the consumer is in the FRUN or RUN state. The offset for the APDU status is calculated using 16-bit arithmetic as the frame length minus 4 without verifying the frame length, allowing a crafted short frame to cause an offset wraparound. This leads to out-of-bounds reads from the receive buffer, potentially causing a denial of service crash or disclosure of memory contents.