Critical Buffer Overflow Vulnerability Affects Pyramid Solutions NetStaX EtherNet/IP Stack

Pyramid Solutions has identified a critical vulnerability in its NetStaX EtherNet/IP Stack software used in industrial control systems. Tracked as CVE-2026-78012, the flaw is a stack-based buffer overflow that affects all versions of the EtherNet/IP Stack prior to v5.6.1.

The vulnerability arises when a large Class 3 explicit-message request exceeds the application-side receive buffer. Unlike typical buffer overflow scenarios, the flaw does not generate an error or warning, potentially allowing silent memory corruption. Consequences may include device crashes, memory corruption, or a remote attack vector without the originating device receiving a CIP error indicating the request could not be processed.

Affected products include the EtherNet/IP Adapter DLL Kit (EIPA), EtherNet/IP Adapter DLL Kit with CIP Security (EIPA-SECURE), EtherNet/IP Adapter Development Kit (EADK), EtherNet/IP Adapter Development Kit with CIP Security (EADK-SECURE), EtherNet/IP Scanner DLL Kit (EIPS), EtherNet/IP Scanner DLL Kit with CIP Security (EIPS-SECURE), EtherNet/IP Scanner Development Kit (ESDK), and EtherNet/IP Scanner Development Kit with CIP Security (ESDK-SECURE), all at versions prior to v5.6.1.

Pyramid Solutions released NetStaX v5.6.1 to address the issue. The update introduces multiple layers of protection, including a compile-time assertion, a runtime payload-size check, and clearer documentation of the relationships between packet and buffer-size constants. The vendor reported the vulnerability to CISA prior to public disclosure.

CISA included the vulnerability in ICS Advisory ICSA-26-246-07, noting deployment across Critical Manufacturing, Energy, Water and Wastewater, and Chemical sectors worldwide. The CVSS v3.1 base score is 9.8 (CRITICAL), with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA recommends minimizing network exposure for control system devices, placing them behind firewalls, and isolating them from business networks. When remote access is required, CISA advises using VPNs updated to the most current version available.