CVE-2026-102714

ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area that ends in a one- or two-byte residue, and the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect handlers then walk it without length checks. A host on the local link can send one such message to make the IP thread read past the packet or loop forever, and can place off-packet memory in the neighbor cache.

Affected Versions

References

Credits