CVE-2026-102721
TFTP client and server copy the ERROR packet message without bounding the read against the packet
CVSS Score
0.0
EPSS Score
0.3%
EPSS Percentile
17th
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without bounding the copy by the end of the datagram, and the TFTP server reads one byte past a minimal ERROR packet. A malicious TFTP server can make the client copy up to 64 bytes of adjacent packet-pool memory into the error string the application retrieves, or fault on targets with memory protection.
| CWE | CWE-125 |
| Vendor | eclipse foundation |
| Product | eclipse threadx netx duo |
| Published | Sep 29, 2026 |
| Last Updated | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for eclipse foundation eclipse threadx netx duo
Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse threadx netx duo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Eclipse Foundation / Eclipse ThreadX NetX Duo
6.0 ≤ 6.5.2.202603a
References
Credits
🔍 L0stHeart Frédéric Desbiens