CISA warns of critical buffer overflow in Pyramid Solutions' NetStaX stack
CISA issued an advisory on a critical buffer overflow in Pyramid Solutions’ NetStaX EtherNet/IP Stack, affecting multiple EtherNet/IP products before v5.6.1.
CISA said a critical stack-based buffer overflow in Pyramid Solutions’ NetStaX EtherNet/IP Stack affects multiple products before v5.6.1 and is fixed in the latest release.
CISA published an advisory on Pyramid Solutions’ NetStaX EtherNet/IP Stack on Sept. 3, saying a stack-based buffer overflow could affect multiple EtherNet/IP Adapter and Scanner DLL Kit and Development Kit products, including CIP Security variants. The advisory identifies the issue as CVE-2026-78012.
The agency said the flaw affects versions prior to v5.6.1. According to the advisory, a large Class 3 explicit-message request could exceed the application-side receive buffer without an error or warning, which could lead to memory corruption, a device crash or a potential remote attack vector. CISA also said the originating device may not receive a CIP error telling it the request could not be processed.
CISA rated the issue critical, with a CVSS v3.1 base score of 9.8 and a CVSS v4.0 score of 9.3. The technology is deployed worldwide and is used in Critical Manufacturing, Energy, Water and Wastewater, and Chemical sectors, the advisory said.
CISA listed Pyramid Solutions as the vendor and said the company is headquartered in the United States. The advisory names affected products as EIPA, EIPA-SECURE, EADK, EADK-SECURE, EIPS, EIPS-SECURE, ESDK and ESDK-SECURE.
For mitigation, CISA said NetStaX v5.6.1 addresses the issue with a compile-time assertion, a runtime payload-size check and documentation about packet and buffer-size constants. The agency also linked to a Pyramid Solutions customer portal and to a company blog post about protecting against silent buffer overflow in Ethernet/IP stack explicit messages.
CISA said Pyramid Solutions reported the vulnerability to the agency. The advisory also said no known public exploitation specifically targeting the vulnerability had been reported to CISA at the time of publication.
The advisory’s initial release date is Sept. 3, 2026, and its revision history notes an initial republication of a Pyramid Solutions blog publication on that same date.
Users of affected products need to move to v5.6.1 and review the vendor guidance referenced in the advisory.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()