CVE-2026-114408

UNKNOWN 0.0

NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.

CWE	CWE-252 CWE-476
Vendor	eclipse foundation
Product	eclipse threadx
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse threadx

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse threadx are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse ThreadX

6.4.5 ≤ 6.5.2.202603a

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-xjgr-2wmf-f78j gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/482

Credits

Frédéric Desbiens