Silent 9.8 Buffer Overflow Found in Pyramid NetStaX Stack

CISA's advisory, published September 3, covers CVE-2026-78012, a stack-based buffer overflow (CWE-121) in the NetStaX EtherNet/IP Stack with a CVSS v3.1 score of 9.8 and a CVSS 4.0 score of 9.3. The vector is about as bad as it gets: network-accessible, low attack complexity, no privileges required, no user interaction, and high impact with no mitigating factors in the vector string (C:H/I:H/A:H). All eight product variants of the NetStaX stack are affected below v5.6.1: the Adapter and Scanner Development Kits and DLL Kits, each offered in standard and CIP Security editions.

What makes this vulnerability worth a closer look is the failure mode. A large Class 3 explicit-message request can exceed the application-side receive buffer without generating an error or warning. The originating device receives no CIP error indicating the request couldn't be processed. The result is memory corruption, a device crash, or what CISA describes as a potential remote attack vector, all without the kind of protocol-level error that would normally land in an operator's log. A device running an unpatched NetStaX stack can be hit over the network, and the first sign of trouble may be that it stops working or starts behaving oddly. There's no alert and no CIP error code to correlate.

NetStaX v5.6.1 layers the fix

Pyramid Solutions addressed the vulnerability with three layers of protection: a compile-time assertion, a runtime payload-size check, and clearer documentation of the relationship between packet and buffer-size constants. Pyramid reported the vulnerability to CISA itself and published a blog post detailing the changes, titled "NetStaX v5.6.1: Protecting Against Silent Buffer Overflow in Ethernet/IP Stack Explicit Messages."

The mitigation path for end users is indirect. The NetStaX stack is a development kit, it's embedded by equipment vendors into their own devices. The organizations that need to patch are the ones whose OT equipment incorporates a NetStaX version below 5.6.1. The real remediation timeline depends on how quickly downstream vendors integrate the updated stack and ship firmware to their customers.

What changes Monday

CISA's recommended mitigations are the standard ICS playbook: minimize network exposure, isolate control system networks behind firewalls, and use VPNs for remote access, with the acknowledgment that VPNs carry their own vulnerabilities. For a vulnerability that triggers no CIP error, network segmentation carries extra weight. If an attacker can reach the device over EtherNet/IP, there may be nothing in the logs to indicate the attempt.

CISA states that no known public exploitation specifically targeting this vulnerability has been reported as of the advisory's publication. The sectors in scope (critical manufacturing, energy, water and wastewater, and chemical) mean the population of potentially affected devices is broad. Pyramid's prior EtherNet/IP stack advisory in June 2022 (CVE-2022-1737, also CVSS 9.8, an out-of-bounds write) affected the same product family and carried a similar worldwide deployment footprint. The open question is how many fielded devices still run versions of the stack predating the v5.6.1 fix, and how long the downstream firmware update cycle will take.