PT-2026-135824

CVE-2026-115403

Published

2026-11-02

Updated

2026-11-02

Description by

CVSS 4.0

8.2

High

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a

Description When built with BSD raw socket and IPv6 support, the IPv6 raw send path fails to verify if a destination-table entry was successfully added. If the destination table is full and an off-link destination is accessed via a default router with an unknown neighbour cache entry, sending on an IPv6 raw socket with header inclusion causes a NULL pointer dereference. A remote sender can trigger this by filling the table, for instance, using ICMPv6 Packet Too Big messages, resulting in a crash of the sending thread.

Recommendations Update Eclipse ThreadX NetX Duo to a version later than 6.5.2.202603a.

Exploitability

Exploit

Fix

Impacts

Researchers

Frédéric Desbiens

Vendors

Affected products

Weakness enumeration

CWE-252: Unchecked Return Value

CWE-476: NULL Pointer Dereference