CVE-2026-115403High· 8.2▾ TwilightIn Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination tab…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.
eclipse_threadx >= 6.0 <= 6.5.2.202603aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114408High· 8.7NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full
CVE-2026-113421High· 7.3ThreadX Modules invokes trace-full callbacks after module unload
CVE-2026-115231High· 8.5User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
CVE-2026-115215High· 8.7NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool
CVE-2026-118052Medium· 6.8Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation
CVE-2026-115653High· 7.0Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode