IPv6 Raw Socket Vulnerability in Eclipse ThreadX NetX Duo
CVE-2026-115403

8.2HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Threadx
Vendor
CVE Published:
2 November 2026

What is CVE-2026-115403?

A vulnerability exists in Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, related to the IPv6 raw send path. When the destination table is filled and an off-link destination is encountered, the system does not validate the success of the entry addition. As a result, the process can dereference a NULL pointer, leading to a system crash when sending data through an IPv6 raw socket. Attackers may exploit this flaw by flooding the table with malformed ICMPv6 messages, potentially impacting system stability.

Affected Version(s)

Eclipse ThreadX 6.0 <= 6.5.2.202603a

References

https://github.com/eclipse-threadx/netxduo/security/advis...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Frédéric Desbiens
.