CVE-2026-78012

Pyramid Solutions NetStaX EtherNet/IP Stack, versions prior to 5.6.1, fails to reject oversized Class 3 explicit-message requests, allowing them to exceed the application-side receive buffer without generating an error or warning. A remote attacker with network reachability to a device's EtherNet/IP explicit-message interface (typically TCP/44818) can trigger the flaw by sending an oversized request, with no authentication or user interaction required. The result is memory corruption — a stack buffer overflow per CWE-121 — that can crash the device and, per the 9.3 critical CVSS 4.0 score, may also provide a remote attack vector with high confidentiality, integrity, and availability impact on the vulnerable component. Affected parties are industrial device OEMs that license the NetStaX stack and the operators of equipment built with affected versions; the data does not enumerate specific downstream products. No public proof of concept is known, the flaw is not in CISA's KEV, and EPSS assigns only a 0.5% 30-day exploitation probability, indicating no known exploitation to date.

What to do: Integrators should rebuild their devices with NetStaX EtherNet/IP Stack v5.6.1 or later, and operators of affected equipment should obtain firmware updates from their device vendors, since patch availability depends on each OEM's release cycle. As an interim mitigation, restrict EtherNet/IP explicit messaging (TCP/44818) to trusted OT network segments and keep affected devices off the internet. When inventorying, ask equipment vendors whether their devices use the NetStaX stack and which version they ship.