In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer 2 segment can send a short MSRP frame declaring a long list and make the MRP worker read far past the received packet, faulting it on targets with memory protection.

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Eclipse
  • Netx Duo

No data.

No data.

References
Link Providers
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-m9hv-hvwf-5qh7 cve-icon cve-icon
History

Wed, 04 Nov 2026 10:45:00 +0000

Type Values Removed Values Added
Description Out-of-bounds Read from Unvalidated MSRP Attribute List Length In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer 2 segment can send a short MSRP frame declaring a long list and make the MRP worker read far past the received packet, faulting it on targets with memory protection.
Title Unvalidated MSRP Length Causes Out‑of‑Bounds Read in NetX Duo Out-of-bounds Read from Unvalidated MSRP Attribute List Length
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse netx Duo
Vendors & Products Eclipse
Eclipse netx Duo

Tue, 29 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unvalidated MSRP Length Causes Out‑of‑Bounds Read in NetX Duo

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description Out-of-bounds Read from Unvalidated MSRP Attribute List Length
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published: 2026-09-29T17:51:03.858Z

Updated: 2026-11-04T10:31:53.318Z

Reserved: 2026-09-29T16:15:20.006Z

Link: CVE-2026-102725

cve-icon Vulnrichment

Updated: 2026-09-29T18:32:39.096Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:12.093

Modified: 2026-11-04T11:17:09.533

Link: CVE-2026-102725

cve-icon Redhat

No data.