CVE-2026-114408High· 8.7▾ TwilightIn Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.
eclipse_threadx_netx_duo >= 6.4.5.202504 <= 6.5.2.202603aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115403High· 8.2NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
CVE-2026-48741High· 7.5libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS
CVE-2026-77207High· 7.5Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication
CVE-2026-64040Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix error return when vfs_mkdir() fails When vfs_mkdir() fails, the error code is not extracted from the returned error pointer
CVE-2026-123059High· 7.5Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
CVE-2026-123047High· 7.5Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts