CVE-2026-115403

UNKNOWN 0.0

NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.

CWE	CWE-252 CWE-476
Vendor	eclipse foundation
Product	eclipse threadx
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse threadx

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse threadx are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse ThreadX

6.0 ≤ 6.5.2.202603a

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9w9h-x3fh-m3fp gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/500

Credits

Frédéric Desbiens